After failed attempts with custom wireguard automation and headscale, I finally found my home in Netbird.
The problem with the alternatives
Raw WireGuard
Wireguard got my attention since it first became available. Its lightweight architecture and simplicity made it an attractive option for smallscale VPN setups. Performance was also on a level the available alternatives like OpenVPN would never reach. But raw WireGuard is merely a protocol, not a solution ready to make managing users and devices easy. Juggling certificates and handing out config files becomes a nightmare as the number of devices grows. And it completely lacks features such as self service device registration, ACL administration, and centralized user management.
Tailscale
Looks like a genuinely good product. Never actually used it though since it's another cloud service, which is not really my favorite for homelab tech. Also I don't want to force my friends and family to create accounts at some third party to join my VPN.
Headscale
The right idea, open source Tailscale server. Unfortunately it's always lacking behind in features and never felt really complete. It relies on the official Tailscale clients while not offering the full feature set of the official Tailscale server. No official management UI, ACLs are quite cumbersome to manage and afaik no self service device registration.
What Netbird does differently
Netbird is its own control plane rather than a reimplementation of someone else's. What really caught me for the SMB and homelab use-case is the IdP integration. Tie Authentik to it and you get one click device registration, IdP group based ACLs and it just works. NAT traversal and relaying work out of the box, it's a single container deployment. It really is a network admins wet dream imho.
Running it
Claude set it up for me in my homelab, a few ports opened, Caddy pointed at it and it runs as expected. The most fiddly part was creating ACLs for some weird use cases I have. Other than that it really works out of the box. Especially the DNS management is exactly what you want for a homenet VPN, it allows you to override only certain domains, while not breaking normal resolution of everything else. Very nice for split horizon setups.
Where I'd still pick something else
If for some reason you have to use "battle tested" enterprise software you will probably end up with ipsec as you have no choice. Other than that I don't see any reason to use anything else right now. Let me know if there was something that bit you with Netbird.