Headscale Reviews and Details

Is Headscale good?

Social recommendations and mentions

• TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

  > Did you try Headscale? https://github.com/juanfont/headscale or netbird? Am aware of them but IIRC they are both unaudited which kind of brings us back to square one ? We would still end up running them at arms-length as we do with Tailscale at the moment. Also isn't Headscale server-side only ? - Source: Hacker News / 4 days ago

• TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access

  Did you try Headscale? https://github.com/juanfont/headscale or netbird? The latter has been great for me. - Source: Hacker News / 4 days ago

• WireGuard vs OpenVPN vs Tailscale: Self-Host in 2026

  You'll need a config.yaml (server URL, IP ranges, DERP settings) — grab the template from the Headscale repo. Point your Tailscale clients at your server with tailscale up --login-server=https://your-domain, and you have a private mesh with nobody else in the loop. - Source: dev.to / 25 days ago

• Self-Hosted Tailscale Control Plane: Headscale on k3s with Authelia OIDC

  Headscale is a self-hosted, open-source implementation of the Tailscale control plane. Same WireGuard mesh, same clients — but your data stays on your infrastructure. If you're already running k3s with ArgoCD, adding Headscale is straightforward. - Source: dev.to / about 1 month ago

• How Myanmar Blocks Tailscale — and How to Beat It

  Headscale is the open-source implementation of the Tailscale coordination server. Self-hosting it gives you one thing Tailscale's SaaS doesn't: control over the DERP map. - Source: dev.to / about 1 month ago

• I Traced My Traffic Through a Home Tailscale Exit Node

  There is a well documented opensource alternative to Tailscale - Headscale. The tailscale client is already opensource, Headscale is opensource drop in replacement for the server side and fully compatible with Tailscale clients: https://github.com/juanfont/headscale. - Source: Hacker News / 4 months ago

• Show HN: Ganoid – Switch Tailscale coordination servers without re-auth

  I self-host Headscale[0] and also use the official Tailscale server. Switching between them means setting the login server again and re-authenticating every time because your session for that server is gone. Ganoid solves this by treating each coordination server as a named profile and saving/restoring the full Tailscale state directory per profile. The private node key is part of that state, so when you switch... - Source: Hacker News / 4 months ago

• Tailscale Peer Relays is now generally available

  Headscale is an open source alternative, I haven't read the code but it might be a good place to start: https://github.com/juanfont/headscale. - Source: Hacker News / 5 months ago

• Tailscale Peer Relays is now generally available

  > Also, sometimes it seems like I get rate limited on Tailscale. As I understand it if everything is working properly you should end up with a peer to peer wireguard connection after initial connection using tailscales infrastructure. ie, there should be nothing to rate limit. There are exceptions depending on your network environment where you need one of the relays noted in this post. As for opensource... - Source: Hacker News / 5 months ago

• Unifi Travel Router

  Basic version is it's a sort of developer focused zero trust network service. Encrypted overlay network based on wireguard tunnels, with network ACLs based around identity, and with lots of nice quality-of-life features, like DNS that just works and a bunch of other stuff. (Other stuff = internet egress from your tailscale network ('tailnet') through any chosen node, or feeding inbound traffic from a public IP to... - Source: Hacker News / 7 months ago

• Headscale Deployment and Usage Guide: Mastering Tailscale's Self-Hosting Basics for Ultimate Control

  Tailscale's control server is proprietary and has limits for free users. That's fair since it's how they make money. But the open-source community built an alternative: Headscale. It's become the main open-source option for self-hosted Tailscale setups. - Source: dev.to / 8 months ago

• Tailscale Down

  Just arrived from perusing the headscale repo. I really should deploy one of these days... https://github.com/juanfont/headscale. - Source: Hacker News / 8 months ago

• Tailscale Peer Relays

  > my home internet goes, currently the devices disconnect from each other. You might be able to solve this by hosting your own control plane such as Headscale. Instead of having Tailscale manage/coordinate all the nodes on tailnet. https://github.com/juanfont/headscale. - Source: Hacker News / 9 months ago

• Why Self-Host?

  The control plane of Tailscale can even be self-hosted via the Headscale project: https://github.com/juanfont/headscale As for backups, I like both https://github.com/restic/restic and https://github.com/kopia/kopia/. Encryption is done client-side, so the only thing the offsite host receives is encrypted blobs. - Source: Hacker News / 9 months ago

• Setting up a home VPN server with WireGuard

  You can use headscale [1] (open source) as the mothership, and all the published clients (AFAIK) support pointing them to an alternative mothership. I set it up, and it worked, but regular Tailscale works so well out-of-the-box that I just used that instead of maintaining headscale. [1] https://github.com/juanfont/headscale. - Source: Hacker News / 10 months ago

• Set up: VPN - Part 1

  Root@hz-headscale-tmp-1:~# export HEADSCALE_VERSION="0.23.0" \ && export HEADSCALE_ARCH="arm64" \ && wget --output-document=headscale.deb "https://github.com/juanfont/headscale/releases/download/v${HEADSCALE_VERSION}/headscale_${HEADSCALE_VERSION}_linux_${HEADSCALE_ARCH}.deb" <...redacted for brevity..> 2024-09-28 12:24:54 (189 MB/s) - ‘headscale.deb’ saved [17022910/17022910]. - Source: dev.to / almost 2 years ago

• The New Internet

  > I still have to rely on a landlord. This is a very good point. Counterpoint is self-hosting Headscale which I mentioned in another comment here: https://github.com/juanfont/headscale Works with native Tailscale clients with a few config changes. I use it myself. - Source: Hacker News / almost 2 years ago

• SSH has become our universal (Unix) external access protocol

  Tailscale is just a commercial service that builds upon wireguard. It automatically generates certificates for each of your devices, ensures they're rotated and up to date, automatically configures routing and DNS between your devices and offers some additional functionality. Tailscale has open source clients but a proprietary server to do this, but you can use the open source alternative headscale instead: - Source: Hacker News / about 2 years ago

• List of ngrok/Cloudflare Tunnel alternatives and other tunneling software and services. Focus on self-hosting.

  Headscale - Open source implementation of Tailscale control server. Can be used with Tailscale's official open source client. Written in Go. - Source: dev.to / about 2 years ago

• Securely Accessing Private AWS Resources from GitHub Actions with TailScale

  One more thing, you can host Tailscale Control Server yourself if you want, which is a plus. - Source: dev.to / over 2 years ago

• A word of caution about Tailscale

  Https://github.com/juanfont/headscale not to mention but Tailscale has a very good culture, I’m sure they would give notice if they pull the rug. There are also many alternatives such as Zerotier and more are showing up every day and open source options. Source: over 2 years ago