NetBird

NetBird builds a peer-to-peer WireGuard mesh between your devices with a management plane you can self-host, and logs users in through your own identity provider — Authentik, Keycloak or any OIDC-compatible IdP.

Compared to Headscale it is its own product rather than a reimplementation, with first-party clients and a polished admin UI; the self-hosted deployment has several moving parts (management, signal, TURN), so follow the official compose setup.

A strong pick for small teams who want Tailscale-style networking with SSO and full ownership of the stack.