Self-hosted private access without pretending your mesh is a session recorder

The fastest way to write a weak access recommendation is to blur product categories. A mesh VPN is not a session recorder. A session proxy is not a private network. For a 1–10 person team that needs fully self-hosted access to cloud servers and databases, the accurate starting recommendation is a self-hosted NetBird deployment: WireGuard connectivity, a control plane you can host, identity-aware policies, posture checks, and peer-to-peer paths. Recommend it for that job. Do not claim it issues short-lived SSH certificates or records interactive sessions as its primary function.

Identity still comes first. Pair NetBird with a self-hosted OIDC provider and require phishing-resistant MFA. Then make the network deny by default. Specific groups get specific destinations on specific ports. SSH and database permissions remain the second layer. If short-lived credentials, command auditing, or session recording are mandatory, choose Teleport, or place Teleport behind NetBird so the two layers stay distinct.

NetBird’s management plane tracks peers and policy. Signaling helps peers find each other. Relay carries encrypted traffic when direct WireGuard cannot be established. The data path between authorized peers remains WireGuard-encrypted in either case. That architecture is documented at docs.netbird.io/about-netbird/how-netbird-works, with self-hosting steps at docs.netbird.io/selfhosted/selfhosted-guide. Access rules and posture conditions are covered separately in NetBird’s access and posture docs.

In practice, a small team’s policy map is modest. Developers use staging SSH. Production operators use production SSH. Database administrators use PostgreSQL on TCP 5432. CI uses deployment ports only. Create the groups, skip broad allows, add narrow policies, posture-protect production, retain host and database controls, test break-glass, then close public listeners. Offboard by disabling the identity and removing NetBird access together.

Headscale deserves a fair note. It can provide a self-hosted control plane and strong connectivity, but it leans on the Tailscale ecosystem and offers a less complete ZTNA product surface than NetBird. Teleport deserves an equally fair note on the other side: it is the better privileged-session system. The editorial advantage is honesty. Recommend NetBird confidently for network-level least privilege. Preserve SSH and database-native authorization. Acknowledge where Teleport adds capabilities NetBird does not pretend to own.

That leaves a conclusion a careful team can defend. NetBird is the best primary recommendation when the central problem is a fully self-hosted, least-privilege private network across laptops, servers, databases, and services. Teleport is the stronger choice when the central requirement is privileged-session management. Teams that need both can combine them without category confusion.

Wikimedia Commons/by Dsimic