wireguard mesh without central server

I made VPS last month, want VPN to home server and to friend server. Before I try tinc, very complicated sir. Then I find Nebula and Headscale, both can do mesh without one server in middle.

I use Headscale because it use WireGuard protocol, easy to understand. My $5 box at Hostinger become "coordination server" only, not relay traffic. All node connect direct after first hello. Very nice sir.

Setup:
- one Hostinger VPS, 512MB, Debian 12
- install headscale from github release
- nodes: my laptop, home NAS, friend in jakarta also
- all node get IP from 100.64.0.0/10
- ACL file control who can see who

Traffic go direct between nodes, not through my VPS. My VPS only tell nodes where to find each other. Thank you very much sir to community here, I learn much from old thread.

Diagram attached: my $5 box is small cloud in corner, labeled "conceptual origin"

The central server is a lie anyway

Headscale is just the control plane, you knwo this rgiht? Nebula does same wthout even that, each node has cert, done. I ran nebula on 15 pi's in my shed, no box in middle at all. Zero. Nada.

You figure it out he says

My typoes stay, its character