Headscale
Self-hosted implementation of the Tailscale control server for a single tailnet.
Technical Architecture & Overview
Headscale re-implements the Tailscale coordination server so that standard Tailscale clients can run against infrastructure you control. It supports ACLs, identity provider integration through OpenID Connect, and single-tailnet operation, and the project is not associated with Tailscale Inc. Feature parity with the commercial control plane is broad but not total.
Targeted Technical Use Cases
Teams that want Tailscale client ergonomics with the control plane inside their own network.
Evaluation & Trade-offs
Core Strengths
- +No dependency on a vendor-hosted coordination service.
- +Uses unmodified Tailscale clients on all platforms.
- +Supports ACLs, grants, MagicDNS, subnet routers, and exit nodes.
Trade-Offs & Limitations
- -The coordination server is self-operated and upgraded by its users.
- -Some commercial-plane features are unavailable.
Defensive Security Application
Mesh connectivity for internal services that keeps authentication metadata in your own environment.
Frequently Asked Questions
What is Headscale?→
Headscale re-implements the Tailscale coordination server so that standard Tailscale clients can run against infrastructure you control. It supports ACLs, identity provider integration through OpenID Connect, and single-tailnet operation, and the project is not associated with Tailscale Inc. Feature parity with the commercial control plane is broad but not total.
What is Headscale used for?→
Teams that want Tailscale client ergonomics with the control plane inside their own network.
What are the strengths of Headscale?→
- +No dependency on a vendor-hosted coordination service.
- +Uses unmodified Tailscale clients on all platforms.
- +Supports ACLs, grants, MagicDNS, subnet routers, and exit nodes.
What are the limitations of Headscale?→
- +The coordination server is self-operated and upgraded by its users.
- +Some commercial-plane features are unavailable.
How is Headscale used defensively?→
Mesh connectivity for internal services that keeps authentication metadata in your own environment.