Link: https://headscale.net/stable/

Fully migrated: learning about policy, config files, defining groups, autogroup settings, preauthkey registration, using tags in place of users and now working through MagicDNS.

I do appreciate there being no webui by default. File-based configuration is really awesome!

So I wanted to get started with tailscale but haven't put in the time and had some security concerns..
Would be interested in your experience.

Regardless of whether you use tailscale or headscale, the central server does not see your traffic. The entire goal of the central server is to help clients find each other, and then get out of the way. At most, tailscale knows your IP addresses, and not much more. The only time tailscale sees your traffic is if you get relayed, instead of directly connected, in which case tailscale see encrypted data that it cannot decrypt.

https://tailscale.com/blog/how-tailscale-works

Their blog posts are excellent, very well written, and full of technical details.

So far, it is great. Definitely takes a moment to wrap the mind around, because you can be very particular.