SUPERSEDED 2026-07-15: day-to-day remote access now runs on NetBird Cloud Free (hosted control plane, nothing self-hosted, no ports forwarded) — see NetBird Remote Access. This matches this page's own conclusion ("hosted mesh, not self-hosted controller") and solves the mobile-UX gap that motivated it. MikroTik WireGuard is retained unchanged as break-glass only (verified end-to-end 2026-07-16).
Status: Decided — stay with MikroTik WireGuard, do NOT self-host Headscale
Reviewed: 2026-05-30
Author: andy (with Claude assist)
The current MikroTik WireGuard hub-and-spoke setup is correctly sized for homelab usage (1 active iPhone, low-volume traffic). Headscale would add a critical-path service without solving an actual problem.
The real friction point — 3 of 5 configured WG peers (iPad Pro, iPad mini, Macbook M5) have never handshaked since setup — is a WireGuard mobile-UX problem, not a control-plane problem.
If that UX gap matters, the right answer is hosted Tailscale free tier (3 users / 100 devices), not self-hosted Headscale.
WireGuard server : MikroTik hAP ax² (router), interface wireguard1
Subnet : 192.168.100.0/24
Lifetime traffic : ↑7.0 GB / ↓861 MB (months of uptime)
Peers configured : 5
● iPhone16PM 192.168.100.3 Active right now ↑2.6 GB
○ peer24 192.168.100.8 Idle (5d ago) ↑16 MB
– iPadProM4 192.168.100.4 Never connected
– iPadmini7 192.168.100.5 Never connected
– MacbookM5Max 192.168.100.6 Never connected
WAN is direct PPPoE with a public IP — no CGNAT, so direct WireGuard works without relay infrastructure.
| Headscale feature | Relevance for this homelab |
|---|---|
| Self-hosted Tailscale control plane | Adds K8s service to maintain + monitor |
| Tailscale client UX (tap-to-connect, auto-reconnect) | ✅ Genuine UX improvement — but available via hosted Tailscale too |
MagicDNS (device.tailnet) |
Marginal — Technitium + .homelab.vyanh.uk already covers internal DNS |
| OIDC SSO via Authentik | Nice but not load-bearing for 5 devices |
| Full peer-to-peer mesh | Not needed — single hub-and-spoke is sufficient |
| DERP relays for CGNAT | Not needed — direct PPPoE WAN |
| Declarative HuJSON ACLs | RouterOS firewall already does this |
Not the controller. WireGuard's mobile UX is the friction:
.conf / QR-code import per deviceTailscale-the-client fixes all of these. That client runs against either:
Are the 3 unused devices unused because (a) you don't need them, or
(b) the WG app is too clunky to bother?
│
├── (a) — leave it. MikroTik WG is fine for 1 active iPhone.
│
└── (b) — there's a real UX problem. Fix options:
│
├── Hosted Tailscale (recommended)
│ • Zero ops on your side
│ • Free tier: 3 users / 100 devices — fits comfortably
│ • Privacy: Tailscale Inc sees device list (not traffic)
│ • Add Tailscale on top of existing WG, no migration risk
│
└── Self-hosted Headscale
• Same client UX as Tailscale
• Adds a critical-path K8s service
• Debug NAT traversal failures yourself
• Justified ONLY if you specifically want to NOT depend on
Tailscale Inc, or want >3 users without paying for Tailscale
feedback_mikrotik_cake_pppoe — would need to be re-validated for any new VPN path.Revisit this decision if any of these become true: