Honestly the managed PKI is the main value-add from Tailscale over plain wireguard.

I’ve been meaning to give this a try this winter: https://github.com/juanfont/headscale