Headscale: The Self-Hosted Solution for Tailscale
Tailscale is a virtual network service that I have been using since the beginning on my home Debian server. Its reliability and ease of use made it the ideal choice, especially because my ISPs used CGNAT, making it difficult to access internal services when I was away from home.
However, curiosity about what happened behind the scenes led me to explore self-hosted solutions. This is where Headscale came into play, an open-source implementation of Tailscale's control server. Headscale allowed me to maintain the same user experience as Tailscale, but with the control server hosted on my VPS instead of Tailscale's cloud servers.
The Initial Setup
The initial installation of Headscale was surprisingly simple. I used a Docker Compose file to deploy it via Portainer stacks. However, I encountered some obstacles. My reverse proxy, Traefik, could not detect the Headscale container. This problem was not due to Headscale itself, but to Traefik's configuration, which was set up to monitor only the Pangolin API.
After resolving this issue, I had to face another obstacle: the serverurl and the basedomain could not share the same domain. Headscale required that the base_domain be a subdomain of the server URL. Once this was also resolved, I finally managed to connect my devices to the Headscale network.
The Final Test
The final test demonstrated that Headscale works as expected. I generated reusable pre-authentication keys, allowing me to connect my devices without having to generate a new key for each device. I connected both my gaming PC and my MacBook Pro to the network using simple command-line commands.
The ultimate test came when I tested connectivity between devices. Although the first attempt failed due to a Windows firewall issue on the PC, the second attempt was a success. Initial response times were in the range of 90-100ms, but quickly dropped to 5-20ms thanks to Tailscale's DERP relays.
The User Interface
Headscale does not include an official user interface, but its documentation recommends some open-source options. I chose headscale-ui for its simplicity and lower impact on my VPS resources. Despite some initial errors, such as "ACL policy not found," I quickly resolved these issues with a command-line command.
The Conclusions
Headscale did not make my network faster or change the way Tailscale works. Its value lies in transferring the control plane to my infrastructure while maintaining the same user experience as Tailscale. Although there were some obstacles along the way, once overcome, Headscale began to feel like something I could commit to long-term.
While I am currently using Tailscale's DERP relays, I am considering the idea of self-hosting them if I decide to give Headscale a permanent place in my stack.
Headscale and Network Security
One of the most relevant aspects of Headscale is the control it offers over the security of your network. Being a self-hosted control server, the user has the ability to implement custom access policies and manage device authorizations more granularly. This is particularly useful in business environments or for advanced users who need a higher level of security than that offered by Tailscale's cloud solution.
Headscale allows you to define ACLs (Access Control Lists) that specify which devices can communicate with each other and which resources can be reached. This level of control is similar to that offered by traditional VPN solutions but with the ease of use of Tailscale. The ability to generate reusable pre-authentication keys, as mentioned in the user experience, is another significant advantage for secure network management.
Performance and Comparisons
During testing, the user noted that initial response times were 90-100ms, but quickly dropped to 5-20ms thanks to Tailscale's DERP relays. This demonstrates that even with a self-hosted control server, network performance does not suffer significant degradation compared to using Tailscale's cloud service. However, for those seeking an even higher level of autonomy, the option to self-host DERP relays may be worth considering.
An interesting comparison is between Headscale and solutions like ZeroTier or Tailscale itself. While ZeroTier offers a more traditional approach to network management, Tailscale stands out for its ease of use and integration with WireGuard. Headscale, on the other hand, combines the simplicity of Tailscale with the control and flexibility of a self-hosted solution.
The User Interface and the Open-Source Ecosystem
Although Headscale does not include an official user interface, the open-source community has developed several solutions to fill this gap. Headscale-ui, for example, is one of the most popular options due to its simplicity and low impact on server resources. However, as highlighted by the user, some initial errors, such as "ACL policy not found," may occur, requiring some familiarity with the command line to resolve.
The open-source ecosystem around Headscale is continuously growing, with new tools and integrations being developed regularly. This makes Headscale a flexible and adaptable solution to different needs, although it requires a certain learning curve to fully exploit its potential.
Future Considerations
The user mentioned the possibility of self-hosting Tailscale's DERP relays in the future. This option could offer an even higher level of autonomy, but would require more complex configuration and additional resources. For those who do not need this level of control, using Tailscale's DERP relays may be a simpler and equally effective solution.
Another aspect to consider is the integration of Headscale with other network automation and management tools. For example, the use of tools like Ansible or Terraform could simplify the configuration and management of Headscale in complex environments. This could make Headscale an even more attractive solution for advanced users and companies looking to automate the management of their network infrastructure.
Final Conclusions
Headscale represents an interesting option for those looking to maintain the ease of use of Tailscale with the control and flexibility of a self-hosted solution. Although the initial setup may present some challenges, once overcome, Headscale offers a user experience similar to that of Tailscale but with the advantage of having complete control over your infrastructure.
For those willing to invest the time needed to configure and manage Headscale, the benefits in terms of security, control, and autonomy can be significant. However, for less experienced users or those who prefer a plug-and-play solution, Tailscale in its cloud form may be the most appropriate choice.
Useful Resources
For those interested in delving deeper into the subject, the official Headscale documentation is an excellent starting point. Additionally, the open-source community around Headscale is very active and can offer useful support and advice for configuration and troubleshooting.
Finally, for those interested in exploring other self-hosted network solutions, articles like "[Replaced Tailscale with raw WireGuard](https://www.xda-developers.com/replaced-tailscale-with-raw-wireguard-for-month-heres-what-i-learned/)" can offer interesting insights and useful comparisons to evaluate the different options available.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.
In the Crypto sector, every investment involves risks: the reader is invited to always inform themselves independently before making any decision.