Headscale
App in the BluixApps catalog
What it is
Headscale is an open-source implementation of the Tailscale control server — coordinate your own private mesh VPN without Tailscale's cloud control plane. Use Tailscale clients (Linux, macOS, Windows, iOS, Android), but with full control over coordination, keys, and policies.
For privacy-bound orgs wanting Tailscale's UX without trusting Tailscale Inc., Headscale is the official-blessed self-hosted answer.
What it's for
- Self-hosted mesh VPN coordination — alternative to Tailscale control server
- Private device network — connect your devices privately
- Site-to-site VPN — branch office connectivity
- Privacy-bound networking — VPN coordination on your infrastructure
- Multi-user network — invite team members to network
Who it's for
- Privacy-bound orgs wanting Tailscale UX without trusting cloud control
- DevOps teams building secure inter-service VPN
- Remote-first companies giving employees secure access
- Self-hosters building secure personal infrastructure
- Tailscale power users wanting more control
Why teams pick Headscale over alternatives
- BSD-3 — fully open
- Tailscale clients work — official iOS, Android, Linux, macOS, Windows
- Coordination on your infra — no cloud dependency
- WireGuard underneath — battle-tested encryption
- Active development — community-driven
- Multi-user / multi-namespace — proper team support
Integrations
- VPN protocols — WireGuard (Tailscale uses)
- Clients — official Tailscale clients (all platforms)
- Authentication — OIDC (any provider), HTTP-Basic, manual approval
- DERP — embedded or external DERP relays
- DNS — MagicDNS (Tailscale's DNS feature)
- ACLs — Tailscale-style ACL language for access control
- API — REST API for programmatic node management
Notable users & community
- 25k+ GitHub stars
- Active community on Discord
- Recognized by Tailscale (compatible with their clients)
- Featured in self-hosted VPN guides
- Strong release cadence
Tips & operations
- OIDC auth recommended — beats local user management
- DERP relays — embedded fine for small; external for scale
- Persistent volume — node state + keys + config
- Backup is critical — lose state = re-onboard all devices
- ACL discipline — define policies upfront
- TLS for control endpoint — Headscale needs HTTPS
What we ship in BluixApps
- Docker compose: Headscale + persistent state volume
- Pinned
headscale/headscale:0.23(release-tagged) - HTTPS via Let's Encrypt
- Embedded DERP relay enabled
- Admin user via CLI on first run
- Persistent volumes for state
- Backup hook covers config + state
Get this app — pick a BluixApps plan
Same catalog. Scaling tenant isolation, white-label and support tier.
| Tier | Tenants | Catalog | Support | White-label | Monthly | |
|---|---|---|---|---|---|---|
| Stacks | 1 | 19 curated stacks | Standard | — | $19/mo | DetailDeploy |
| Starter | 10 | Full catalog | Standard | +$15–25/mo | $49/mo | DetailDeploy |
| Pro | 25 | Full catalog | Priority bugfix | +$15–25/mo | $149/mo | DetailDeploy |
| Growth | 100 | Full catalog | Priority bugfix | +$15–25/mo | $349/mo | DetailDeploy |
| Scale | 500 | Full catalog | 7-day window | +$15–25/mo | $799/mo | DetailDeploy |
| Enterprise | Unlimited | Full catalog | Priority 7-day | Bundled | $1,499/mo | DetailDeploy |