Tailscale doesn't offer an official self-hosted control server, right? That seems to be an advantage of NetMaker.

It has no equivalent to tailnet lock, though, as far as I can tell.