I used Nebula extensively.

I really liked it. I like the idea of embedding firewall rules in a certificate.

But , like you observed, it does not scale as well as tailscale.