Useful timing for this to hit my feed — I just moved my lab off a self-hosted Headscale instance precisely to stop being everyone's single point of failure, so the "no coordinator to trust" pitch is exactly the itch I had.

Practical notes for anyone trying it, from someone who runs two other meshes today:

• The iroh fallback relay question is the real trust question, not the coordinator. If you set ray config set relay https://your-relay/ alongside the defaults, verify with ray status which relay a given peer actually used (ray status shows the path) — a bad custom relay with --replace can silently isolate nodes behind hard NAT.
• For the ~10% NAT-fallback cases, the fixed UDP 41383 forward is per-LAN, not per-machine — in a dorm/office with several nodes only one benefits, so plan which node gets the manual forward.
• The embedded mesh SSH (ray firewall ssh on) is convenient but note the current limitation in the README: an authorized peer can log in as any local user. If you're using it for anything beyond a homelab, gate it with the per-device firewall rules (--peer scoped) rather than leaving it network-wide.

Compared to my Tailscale setup the missing piece so far seems to be ACL-style reachability policy between networks (they have networks-as-code YAML, which looks like a step in that direction). Curious whether anyone here has run it long-term and how the DHT discovery behaves after the coordinator machine is gone — does the signed record survive expiry?