Link: https://headscale.net/stable/

Fully migrated: learning about policy, config files, defining groups, autogroup settings, preauthkey registration, using tags in place of users and now working through MagicDNS.

Use grants rather than ACLs, they're the "new" way of doing access control. Host a full-fledged DNS resolver inside your Tailnet (AdGuard Home, Pi-hole etc) to do adblocking and local zones, the MagicDNS custom records are very rudimentary. If you intend to integrate with a third-party UI, doublecheck which Headscale version they support and ask in the Discord, since they usually lag behind a bit. Prioritize peer relays over DERPs for performance.

No ui for me, but I like the concept of https://github.com/yellowsink/ouroboros