Apps / Network
Headscale
An open source, self-hosted implementation of the Tailscale control server
An open source, self-hosted implementation of the Tailscale control server. Tailscale is a modern VPN built on top of Wireguard. It works like an overlay network between the computers of your networks - using NAT traversal.
CategoryNetwork
Memory~120MB
Module
headscaleInstalling it
Open the dashboard, go to Apps, press Add on it and apply the change. Or from a terminal on the box:
sudo homebox install headscaleWhere to open it
| Service | Port | First login |
|---|---|---|
| Headscale | — | — |
| Headscale UI | — | — |
| Headscale Proxy | :8091 | The web UI is at /web. It asks for an API key — make one with homebox exec headscale headscale apikeys create. |
Open it at your box's address with that port — the dashboard links to it directly once it is running.
Good to know
- The Tailscale APP is the client and this is the server. Point a client at it with
tailscale up --login-server https://your-headscale-host— the official mobile apps need a custom server set before login - Clients reach this over HTTPS with a real certificate, so it has to be published: put it behind the Proxy module or the Cloudflare Tunnel and set the URL below to that hostname
- server_url is written into every client's config when it enrols. Changing it later means every device has to log in again, so decide the hostname before you enrol anything
- config/data holds db.sqlite AND noise_private.key. The key IS this server's identity — restore both together or every device is a stranger again
- Create devices from the web UI at /web: make a pre-auth key, then run
tailscale up --login-server <url> --authkey <key>on the machine