zrok would work, OpenZiti (which zrok is built on) is probably a better comparison to Tailscale IMHO. zrok is a 'ziti-native' app which includes functions to replace Ngrok/Cloudflare Tunnels/Tailscale Funnels (i.e., publicly share resources) while also being able to do other use cases, e.g., private shares, VPN replacement, Caddy, filshares.

OpenZiti is the lower-level overlay network which can be configured for any use case. It implements zero trust/deny-by-default principles more rigorously than Tailscale, its open source as you say, and includes SDKs for many languages to enable app-embedded. Unlike 'tsnet', the SDKs do not have a userspace TCP/IP networking stack as its not needed.

zrok, being built on OpenZiti, benefits from the Ziti SDKs too. We already put wrappers around the Golang, Python, and NodeJS SDKs. Could do many more.