raw wireguard makes you hand-maintain n² peer configs as the mesh grows. tailscale (or headscale, self-hosted) handles nat traversal and meshing for you; each node keeps its own key, you register once, and an acl replaces per-peer allowedips
about 1 month ago