This is the way.

Edit: For the record, I think Tailscale (as a company) builds excellent software and I like the idea of them making money and staying alive to keep doing the great work they do. I personally feel uneasy about using their proprietary control server in my own (home, etc.) networks, but I honestly wouldn’t even think twice about it if I was making that decision on behalf of a company.

Fwiw (in my opinion, it's a great show of support by Tailscale), Tailscale actually hired and fully supports the person who maintains Headscale.

I had not heard that, and Juan's twitter says he works at the European Space Agency.

On the other hand, they certainly have on a few ocassions gone out of their way to help Headscale, like documentation the changes to the V2 control server protocol, and even putting some relevant code in the open source repo to make it easier for Headscale.

Plus they try to keep backwards compatible with older control servers in the client, and trying not to break headscale is something that has been mentioned a few times in pull requests reviews.

Isn't it more likely that this would have unfound vulnerabilities in it, and you'd still need to have this open to the internet to get similar benefits to Tailscale proper?