Tailscale.
The default mesh until the ISP says otherwise; ACLs per port, not blind LAN trust.
WireGuard mesh with identity-based ACLs: an inventory scanner reaches one port on one host, never the whole subnet. New branches onboard with an install. Not a hardware shipment.
Carries the 10-branch retail network documented in ~/work/unified-it-infrastructure-and-digital-transformation-at-maryana-group.
The mesh replaced Sophos and Cyberoam hardware VPNs that dropped connections regularly, eliminating roughly $2,500 a year in proprietary hardware support and licensing. Prometheus scrapes confirm the result, with 10/10 branch targets up. New branches are now a software install, not a hardware shipment. See ~/work/unified-it-infrastructure-and-digital-transformation-at-maryana-group.
used_in: ~/work/unified-it-infrastructure-and-digital-transformation-at-maryana-group