Do I keep the Tailscale app?

With Headscale, yes — you point the official client at your server. NetBird uses its own clients.

frp is a public tunnel (/replace/ngrok). Tailscale is private mesh networking. Different job.

Stacks / Backend

Medium

Headscale / NetBird

A mesh VPN you host. Headscale is BSD-3; NetBird is AGPL-3.0 — Tailscale without the coordination seat.

The problem

Tailscale is WireGuard plus a coordination server you do not run. Headscale is the BSD-3 open-source control server that speaks the Tailscale client protocol. NetBird is AGPL-3.0 if you want that mesh instead. Clients stay on the devices. This is not every Tailscale ACL, exit-node, or app-connector product.

Replaces

Tailscale

Replace Tailscale

Estimated SaaS saved

$1,200

per year, small team, before lock-in

Start on Railway

frp if this is a public URL, not a mesh VPN

Sponsor this stack Tip jar

Placeholder: Headscale (or NetBird management) plus a volume for the node database. Clients stay on laptops and servers. No one-click template in this repo yet — Start on Railway. Public tunnels stay on /stacks/frp-tunnel.

The stack

Headscale
BSD-3 Tailscale-compatible control server
NetBird
AGPL-3.0 WireGuard mesh if you want that stack

Cost table

You stop paying	Typical / year	Self-host instead
Tailscale paid coordination (small team)	$1,200	Headscale or NetBird

Agent setup prompt

Replace Tailscale coordination with Headscale (preferred) or NetBird.

- Headscale: persist the database, bind the API, issue a preauth key, join one official Tailscale client.
- NetBird if you want their management UI instead of the Tailscale client protocol.
- Write AGENT_PROMPT.md. Do not claim every Tailscale ACL or exit-node feature.

Also as markdown: /stacks/headscale-vpn.md

FAQ

Do I keep the Tailscale app?: With Headscale, yes — you point the official client at your server. NetBird uses its own clients.
Why not frp?: frp is a public tunnel (/replace/ngrok). Tailscale is private mesh networking. Different job.