H
- Category
- Network · Self-host
- Cost
- Self-host
- Country
- community
- Licensing
- FOSS
- Platforms
- Linux · macOS · Windows
Pros and cons
+ what works
- +Use the stock Tailscale clients while controlling the coordination plane yourself
- +BSD-3-Clause, small Go codebase, runs as a single binary
- +No tenant on Tailscale Inc.; keys never leave your server
- +SQLite or Postgres backend; trivial to back up
− watch out for
- −Intentionally lags Tailscale's hosted control plane (no Funnel, partial Serve, no flow logs)
- −Small maintainer bench, one of whom is employed by Tailscale Inc.; bus factor is a real concern for production
- −OIDC group membership cannot be used in ACLs
- −Tailscale offers no compatibility guarantees; upstream protocol changes can break Headscale until the maintainers catch up
Privacy notes
Headscale is an unofficial, FOSS re-implementation of Tailscale's coordination server. It speaks the same control protocol, so the stock Tailscale clients on every platform connect to it unchanged, but keys and node metadata stay on a server you operate. Traffic between nodes remains peer-to-peer WireGuard as with Tailscale; only coordination (DERP routing, node discovery, ACL distribution) moves. The project is BSD-3-Clause and lives at github.com/juanfont/headscale. No telemetry, no SaaS dependency.
Tags
#foss · #bsd-3 · #tailscale-compat · #wireguard · #mesh-vpn
Comments (0)
No comments yet. Be the first.