Why spying tailscale? Nebula lets you run your own CA
Discussion
I might be wrong here, but I don’t think nebula has any benefit over Tailscale if you host it yourself using headscale
Check what derp server map is and what is your client dns ip is after connecting to tailscale.