Tailscale is “mostly” self-hosted, in that the VPN connection itself is peer-to-peer almost all the time. You can host your own Headscale and DERP/Relay servers to make it fully self-hosted, but tbh I’m fine not self-hosting the control plane.

The relay server is only used if both ends have very restrictive NAT and none of the NAT hole punching techniques work, which is rare other than on very locked down corporate networks. If you have IPv6 enabled on both ends, you shouldn’t have issues making a direct connection, as IPv6 doesn’t use NAT. Even with regular NAT (like a home internet connection) on both ends, Tailscale can use UDP hole punching on both ends to establish a direct connection.