Tailscale Went Seat-Based: What Self-Hosting Your Admin VPN With NetBird or Headscale Actually Costs

A twenty-operator platform team just watched its mesh VPN bill become a headcount tax: at Tailscale's 2026 seat-based prices, keeping every operator on the tailnet costs 160 dollars a month on Standard or 360 dollars on Premium — for a coordination server that never touches a single byte of your traffic. The packets already flow peer-to-peer over WireGuard. What you are renting is the control plane: identity, key exchange, ACLs. And that is the one part you can now self-host for the price of a small VPS.

This post does the math all the way down. What Tailscale's pricing overhaul actually changed, what a self-hosted NetBird or Headscale control plane costs in both infrastructure and ops hours, the exact seat counts where each option crosses over, and the honest ops bill — patching, backups, on-call — that decides whether the crossover is real for your team.

The bill that changed​

Tailscale's fourth pricing overhaul, pricing v4, made two moves at once. On the personal side it retired Personal Plus (again) and made the free Personal plan more generous: up to six users with unlimited devices. On the business side it abandoned usage-based billing in favor of simple per-seat pricing — Starter became the more capable Standard at 8 dollars per user per month, and Premium sits at 18 dollars per user per month with just-in-time access, network flow logs, and log streaming.

Tailscale's own rationale is refreshingly candid: usage-based elegance created invoicing friction, procurement teams want side-by-side seat comparisons, and accounting teams would rather not discover the bill after the month ends. Fair. But seat-based pricing has a shape worth naming: the bill scales with headcount, not with infrastructure. Every contractor, every new hire, every break-glass operator account is another 8 to 18 dollars a month, forever — while the number of machines being administered barely moves the number at all.

For a team that owns its servers outright, that shape grates. You bought the Hetzner machines to escape per-unit metering on compute. Now the VPN that gates SSH to those machines meters per human instead.

The math, up front: three columns, two crossovers​

Here is the core comparison. A "seat" below means one operator who needs admin access — SSH to management-plane nodes, internal dashboards, cluster APIs — not every employee in the company. Self-hosted costs are flat across node counts: whether the mesh covers 5 nodes or 500, the control plane is one small deployment.

To find the crossovers, price ops time at 100 dollars per hour — fully loaded, roughly right for a platform engineer in 2026:

• NetBird self-hosted steadies at roughly 106–212 dollars per month (10 dollars of VPS plus 1–2 hours of upkeep). That crosses Tailscale Standard at ~13–26 seats and Premium at ~6–12 seats.
• Headscale self-hosted steadies at roughly 55–60 dollars per month (5 dollars of VPS plus half an hour of upkeep). That crosses Standard at ~7 seats and Premium at ~3 seats.

Two sensitivity notes before you quote these numbers in a planning doc. First, the crossover moves with your ops rate: at 50 dollars per hour of founder time, every crossover seat count roughly halves; at 150 dollars per hour it moves up by half. Second, setup is amortized, not free — NetBird's ~4 hours is a real half-day, and the first month always costs more than the steady state. Neither caveat changes the shape of the answer: past a handful of operators, the SaaS bill is paying mostly for convenience, not capacity.

What you would actually be self-hosting​

The reason the self-hosted column is so small is architectural. In a WireGuard mesh, the data plane is already yours: once two nodes authenticate, their encrypted session flows directly between them. The coordination server only handles the control plane — node registration, key distribution, ACL evaluation, and NAT-traversal signaling.

That is a light workload. It needs no GPU, no big disk, no horizontal scaling at any team size this post cares about. A single small VPS with backups is genuinely enough, which is why both self-hosted options below run happily on the cheapest machine your provider sells.

It also explains the asymmetry at the heart of this post: Tailscale has never offered a self-hostable control plane. The clients are largely open source, but the coordination server is SaaS-only — the one component you cannot take with you. Both alternatives below exist specifically to fill that gap.

Option A: NetBird, the full-feature self-host​

NetBird is the Berlin-based open-source zero-trust platform that closed a 10 million dollar Series A led by Pace Capital in January 2026 — funding that matters because it answers the "will this project exist in two years" question every self-hosting decision quietly asks.

Its distinguishing bet is feature parity: the self-hosted deployment ships the same stack as NetBird Cloud — SSO and MFA, granular ACLs, device posture checks, private DNS, network routes, event streaming, a public API, and a Terraform provider. There is no self-hosted tax where the serious features stay SaaS-only. Recent releases run into the v0.7x series with dual-stack IPv6 support, and the project publishes a combined self-hosted server (management API, signal server, embedded Dex IdP, dashboard) aimed at Docker-based installs.

Setup looks like this: one host running the NetBird stack behind your domain, pointed at either the embedded IdP or your existing SSO, with peers enrolled via setup keys. The ~4-hour setup estimate covers TLS, SSO wiring, ACL policy authoring, and enrolling the first nodes — the ACL design is the long pole, not the install. Upkeep is dashboard upgrades, IdP certificate rotation, and ACL maintenance as operators join and leave.

NetBird also offers a middle path worth pricing: NetBird Cloud's Team tier runs about 5 dollars per user per month — cheaper than Tailscale Standard, with the self-hosted escape hatch intact if you ever outgrow it. That makes NetBird the rare vendor where the SaaS-to-self-hosted migration is a supported direction, not a rewrite.

Option B: Headscale, the lean Tailscale-API clone​

Headscale takes the opposite approach: instead of a full platform, it is an open-source reimplementation of Tailscale's coordination server API, BSD-3 licensed, that works with the unmodified official Tailscale clients on every platform. If your operators already run Tailscale apps on their laptops and phones, switching control planes changes nothing on their devices — the client cannot tell it is talking to your server.

That compatibility is the whole pitch. Headscale reached v0.28 in May 2026, ships as a single Go binary backed by SQLite or Postgres, and pairs with Headplane for a web admin UI. Production stories are no longer exotic: consultancies like Infralovers have run Headscale as their internal control plane for over a year, and deploy templates exist for Railway and plain Docker hosts. Tailscale's own stance has mellowed accordingly — with a Headscale maintainer now employed at Tailscale, the project reads as tolerated infrastructure rather than a terms-of-service gray zone.

The tradeoff is scope. Headscale implements the coordination protocol, not Tailscale's SaaS feature surface: expect ACLs and solid core networking, but not Premium-tier flow logs, posture integrations, or just-in-time access. Setup is genuinely an hour or two — binary, config file, OIDC wiring if you want SSO, Headplane for the UI — and upkeep is mostly version bumps. That leanness is exactly why its crossover sits at ~3–7 seats: there is almost nothing to operate.

Head-to-head: Tailscale SaaS vs. NetBird vs. Headscale​

Read the table's bottom half, not just the top: the SaaS column wins every "someone else's problem" row, and the self-hosted columns win every lock-in and metering row. There is no option that wins both halves. Anyone telling you otherwise is selling one of them.

The ops bill nobody puts in the table​

The crossover math assumed upkeep hours appear on schedule and incidents never happen. They do not, so here is the honest version.

Patching and upgrades. A VPN control plane is internet-facing authentication infrastructure: it gets patched promptly or it becomes the story. NetBird's Docker stack means watching release notes and rolling the compose stack monthly-ish; Headscale means swapping a binary a few times a year. Budget the hours from the table above, then add 50 percent the first two quarters while you learn each project's failure modes.

Backups and recovery. The control plane holds network state — machine keys, ACLs, routes. Lose the VPS disk without a backup and every node re-enrolls from scratch while nobody can SSH anywhere. Both options back up to a file or database dump you can ship off-box in minutes; the cost is not the backup, it is the quarterly restore drill nobody wants to schedule. Schedule it anyway: this box gates all admin access, so its recovery procedure is your company's "the VPN is down" runbook.

High availability (or deliberate non-HA). Here is the uncomfortable truth both self-hosted options share: the default deploy is a single box, and a dead control plane means no new connections, no ACL changes, and no node enrollments until it returns. Existing peer-to-peer sessions keep flowing — WireGuard does not phone home mid-session — but you cannot add the new operator or revoke the departing one during the outage.

For a 15-node fleet this is usually acceptable with fast recovery. For larger fleets, NetBird's components can be split and Headscale can sit behind Postgres with a standby — but now you are operating distributed infrastructure to avoid a SaaS bill, and the crossover math needs re-running with those hours included.

On-call. Someone carries the pager for the box that gates SSH. On a 3-person team that is everyone, and the 0.5–2 hours per month understates the real cost: context-switching onto VPN duty at 2 AM. On a 30-person platform team with an existing rotation, the marginal cost is near zero — the VPN joins a fleet of small services already under monitoring.

That team-size split is the actual decision rule. A 3-person team where nobody wants pager duty should usually just pay Tailscale Standard: 24 dollars a month for 3 seats is cheaper than any incident. A 15-plus-operator platform team already running on-call for its Hetzner fleet will barely notice one more small service — and at 15 seats on Premium, the 270-dollar monthly bill funds a lot of VPS.

Pick one (and the lock-in footnote)​

• Stay on Tailscale SaaS if you have fewer than ~7 operators, no on-call rotation, or a genuine need for Premium-tier flow logs and posture integrations without operating them. The seat bill is small at this size and the convenience is real.
• Self-host NetBird if you want the full enterprise feature stack — SSO, posture checks, event streaming, Terraform — on infrastructure you own, with a funded vendor and a cloud tier to retreat to. The crossover starts around 6–13 seats depending on your Tailscale tier.
• Self-host Headscale if your team already lives in Tailscale clients and you want the smallest possible control plane to own: one binary, one policy file, crossover at ~3–7 seats. Accept the thinner feature surface with open eyes.

And the footnote the TODO spec asked for, honestly stated: a control plane you cannot self-host is the same lock-in shape as a PaaS you cannot self-host. Tailscale's clients are open, its wire protocol is documented, and still the one server that matters is SaaS-only — which is precisely why Headscale exists and precisely why NetBird's parity bet resonates. Teams that own their machines tend, sooner or later, to want to own the thing that gates access to them. The seat-based bill just made "sooner" arrive on a schedule.

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.