Hacker News Reader

Maybe Nebula? You can do one yaml config file with all the certificates and firewall rules making it easy to script device provisioning too.

I'm mainly looking for a solution that punches through NAT the way Tailscale does.

Nebula has NAT punching as well[1]. Or does Tailscale do even more magic on it?

It seems to have relays which is interesting. For comparison, here is Tailscale's article on how they do NAT traversal: https://tailscale.com/blog/how-nat-traversal-works/