Headscale

Headscale is an open-source, self-hosted implementation of the Tailscale control server. Tailscale itself is a zero-config VPN built on WireGuard, and its commercial offering includes a cloud control plane that handles device registration, key exchange, and routing. Headscale replaces that cloud control plane with one you run yourself.

If you have self-hosted services across multiple machines and want to connect them with encrypted WireGuard tunnels without punching firewall holes or managing static IPs, Tailscale’s architecture solves that cleanly. Headscale lets you use all the official Tailscale client applications (including iOS, Android, macOS, and Windows apps) while keeping the coordination server on your own hardware.

The setup is straightforward: deploy Headscale on a server with a public IP, configure your devices to point at your instance rather than Tailscale’s servers, and your private network operates entirely off your infrastructure. All the WireGuard tunnel logic and peer-to-peer routing still works the same way.

Headscale explicitly scopes itself to a single tailnet for personal use or small organizations. It does not attempt to replicate every feature of Tailscale’s commercial platform, and the maintainers are clear about this. For enterprise VPN management with fleet-scale controls, it is not the right tool. For individuals and small teams who want private network connectivity without a third-party control plane, it covers the core requirement well.