OpenZiti
Apache-2.0 zero-trust overlay you embed into the application itself. The whole stack, controller included, is self-hostable with no capability paywall. NetFoundry sells only managed hosting and support.
VPN & Remote Access
Category: VPN & Remote Access under Security & Privacy
Headscale
BSD-licensed control server that runs official Tailscale clients on coordination infrastructure you host, no proprietary cloud. Volunteer-maintained; no GUI, RBAC, or commercial support.
NetBird
WireGuard mesh VPN with a control plane you self-host, the EU-sovereign answer to Tailscale. OIDC SSO included; active-active HA, SCIM, and SIEM streaming are commercial.
RustDesk
AGPL-3.0 remote desktop platform: fully private relay keeps session data off third-party infrastructure. SSO, auditing, and device management require the paid Pro tier.