Their sales team, when I asked about self-hosing a controller, said it's not necessary because they've never had all the hosted controllers go down, but when I asked about a tweet they sent in May 2020 about their controllers being down, I never got a reply. [1]
My plan was to put ZeroTier on all of our machines and use it as an overlay network that all traffic goes over. But I don't want to open the availability of our network to depending on an external service.
I've all but decided on Nebula, just need to get the deployment worked out. I'm playing with Tailscale right now, and am very impressed. It does have the ability to require MFA on logins that we would like for user VPNs, while still being able to have servers self-authenticate (we respin half of our dev/stg environment every night).
[1] https://twitter.com/ZeroTier/status/1389766385480372225?s=20
i can't say about that specific thing but i've been using this daily 24x7 for the last 2 years now. it connects my 20+ pcs and laptops which are geographically apart but because of zerotier, they are in a local lan.
it does not have SSO, relying on the admin accepting/rejecting connected devices by a single checkbox. this is in comparison to tailscale which uses Oath, meaning you have to create and maintain those accounts as well.