Self-host Headscale

VPN & Mesh Networking

deployed & timed by usprices checked · Jul 2026

An open-source, self-hosted implementation of the Tailscale control server — run your own coordination plane for a private WireGuard mesh and keep using the official Tailscale clients, without depending on Tailscale's hosted service.

Tailscale / yr$96

Self-hosted / yr~$55

You keep$41/yr

Pocket the difference — spin it up on a cheap VPS in minutes.Start free on Kamatera →

Key facts

CategoryVPN & Mesh Networking

LicenseBSD-3-Clause

StackGo

Min RAM256 MB

Dockeryes

Difficulty

What you need

Any VPS with at least 256 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
About an afternoon — budget time for troubleshooting

Install

Run these commands on your server:

# Headscale — control server only (no web UI); needs a config.yaml + TLS on 443
mkdir -p ./headscale/config ./headscale/data && cd ./headscale
curl -fsSL -o config/config.yaml https://raw.githubusercontent.com/juanfont/headscale/main/config-example.yaml
# Required edits: set server_url to your https:// URL, and change
# listen_addr from 127.0.0.1:8080 to 0.0.0.0:8080 or the port won't publish.
docker run --name headscale -d -p 443:8080 \
  -v $(pwd)/config:/etc/headscale -v $(pwd)/data:/var/lib/headscale \
  headscale/headscale:stable serve

deploy guideHow to Deploy Headscale on a VPS vps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

An alternative to

Tailscale →

Head-to-head

VPNJul 2026

Headscale

NetBird

An all-in-one mesh vs. your own Tailscale control plane.

The simplest WireGuard VPN vs. your own Tailscale mesh.

Read the verdict →

More in VPN & Mesh Networking

VPN & Mesh NetworkingNetBird

An open-source WireGuard-based mesh VPN that connects your devices, servers, and clouds into a single private network with SSO and access controls — a self-hostable alternative to Tailscale and Twingate. The client is BSD-3-licensed; the self-hosted control-plane components (management, signal, relay) are AGPL-3.0.

hardRead guide →

VPN & Mesh NetworkingPangolin

A self-hosted tunneled reverse proxy that exposes services on your private network to the internet over WireGuard, with built-in identity, access control, and automatic SSL. A self-hostable alternative to Cloudflare Tunnel that keeps the ingress on a server you own.

TypeScriptGo

moderateRead guide →

VPN & Mesh Networkingwg-easy

The easiest way to run your own WireGuard VPN server, with a clean web UI for adding and managing clients — a self-hosted alternative to Tailscale and commercial VPNs for private access to your network from anywhere.

TypeScriptNode.js

easyRead guide →

Command Palette