Headscale gives you the half of Tailscale that isn't open source: the coordination server. Run it yourself and the official Tailscale clients (with their excellent NAT traversal and platform support) connect to infrastructure you control, with no per-user pricing and no third party holding your network's keys. This guide is the practical walkthrough: install from the official packages, TLS done the simple way, users and ACLs, the embedded DERP relay on your own network, and the honest operational limits of a deliberately small project.

WireGuard is the protocol all three products are built on, so "WireGuard vs Tailscale" is the wrong framing. The real question is who runs your control plane: Tailscale's SaaS, a self-hosted Headscale, NetBird's fully open stack, or nobody (raw WireGuard). This guide draws the protocol-vs-control-plane-vs-relay map cleanly, compares the four on the dimensions you actually decide on, explains why kernel and userspace WireGuard perform differently, and gives an infrastructure operator's verdict, including the angle the vendor-written SERP ignores: mesh access into management and out-of-band networks.