[{"data":1,"prerenderedAt":138},["ShallowReactive",2],{"seo-verification":3,"blog-self-host-headscale-on-a-vps-your-own-tailscale-control-server-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":85,"ctaBody":86,"ctaButton":87,"ctaUrl":88,"relatedPosts":89},164,"self-host-headscale-on-a-vps-your-own-tailscale-control-server",{"fr":10,"en":8,"ar":11},"self-host-headscale-tailscale-vps","استضافة-headscale-على-vps-خادم-تحكم-tailscale-خاص-بك","Self-Host Headscale on a VPS: Your Own Tailscale Control Server","Replace Tailscale's cloud control server with Headscale on your own VPS — unlimited users, full WireGuard mesh networking, magic DNS and ACLs, with no SaaS dependency.",5,0,false,"2026-07-05T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-headscale-tailscale-vps-poster.svg",{"categorySlug":30,"appSlug":31},"networking-vpn","headscale","Tailscale's free tier caps you at 3 users and stores your network map in the cloud. Headscale (BSD-3-Clause, ~41k stars) is a drop-in open-source replacement for the Tailscale coordination server — deploy it on your VPS and keep using the official Tailscale clients on every device. Your team connects with zero-trust WireGuard tunnels, magic DNS, and ACL-based access control, all self-hosted and unlimited.",[34,38,50,53,78,82],{"type":35,"title":36,"body":37},"h2","Why self-host the control server","Tailscale is exceptional software — WireGuard performance, cross-platform clients, magic DNS that just works. The control plane (the coordination server that distributes keys and ACLs) is what runs in Tailscale's cloud. Headscale reimplements that coordination server in open-source Go so you can run it on your own infrastructure.\n\nBeyond the 3-user free tier limit, the main reason to self-host is data residency: the control plane knows which machines are on your network, their IPs, and your ACL policies. Running Headscale means that information stays on your VPS — not in someone else's cloud.",{"type":39,"title":40,"items":41},"ul","What self-hosted Headscale gives you",[42,43,44,45,46,47,48,49],"Unlimited users and devices: no 3-user cap, no per-seat pricing — your mesh scales with your team.","Official Tailscale clients everywhere: Linux, macOS, Windows, iOS, Android — no custom fork or alternative client required.","WireGuard peer-to-peer tunnels: Headscale only handles key exchange and ACL distribution; all actual traffic is direct WireGuard between peers.","Magic DNS: resolve every node in your mesh by hostname (machine.headnet.local) without modifying public DNS.","HuJSON access control lists: the same ACL policy format as Tailscale — define which users and devices can reach which services.","DERP relay support: use Tailscale's public DERP map for NAT traversal, or deploy your own private relay.","REST API and headscale CLI: create namespaces, issue pre-auth keys, and manage peers programmatically.","Under 50 MB RAM at idle — runs comfortably on a 1 GB VPS alongside other workloads.",{"type":35,"title":51,"body":52},"Requirements","A VPS with at least 1 vCPU and 512 MB RAM running Ubuntu 22.04, with Docker and Docker Compose v2 installed. A domain name pointing to the VPS is **required** — Tailscale clients connect to the control server by URL, and HTTPS (via a reverse proxy like Caddy or Nginx with Let's Encrypt) is strongly recommended. Port 8080 must be reachable from the internet (or just from your devices if you prefer an internal-only control plane).",{"type":54,"title":55,"steps":56},"steps","Deploy Headscale with Docker Compose",[57,60,63,66,69,72,75],{"title":58,"body":59},"Write the Compose file","Create `\u002Fopt\u002Fheadscale\u002Fcompose.yaml`. The stack is a single service: `headscale\u002Fheadscale:0.29.2`. Headscale stores everything — keys, database, node records — in named Docker volumes mounted at `\u002Fetc\u002Fheadscale` (config) and `\u002Fvar\u002Flib\u002Fheadscale` (data). No external database or cache service is required; SQLite is built in.",{"title":61,"body":62},"Generate the configuration","Headscale reads its configuration from `\u002Fetc\u002Fheadscale\u002Fconfig.yaml`. The minimum required field is `server_url` — the HTTPS URL your Tailscale clients will connect to (e.g. `https:\u002F\u002Fvpn.yourdomain.com`). Set `listen_addr: 0.0.0.0:8080` and `database.type: sqlite3` with a path under `\u002Fvar\u002Flib\u002Fheadscale`. The private key paths (`private_key_path`, `noise.private_key_path`) will be auto-generated by Headscale on first start if they do not exist. On ServOrbit, the provisioning job writes `config.yaml` from your domain automatically.",{"title":64,"body":65},"Start the container and verify","Run `docker compose up -d`. Headscale will auto-generate its WireGuard private key and noise key, then start listening on port 8080. Check the health endpoint: `curl -s http:\u002F\u002Flocalhost:8080\u002Fhealth` should return `{\"status\":\"pass\"}`. The headscale CLI is available inside the container: `docker exec headscale headscale version` to confirm the running version.",{"title":67,"body":68},"Create a user and generate an auth key","Tailscale organizes devices into 'users' (formerly namespaces). Create one: `docker exec headscale headscale users create myteam`. Then generate a pre-authentication key to register devices: `docker exec headscale headscale preauthkeys create --user myteam --reusable --expiration 24h`. Copy the printed key — you will use it when registering each device.",{"title":70,"body":71},"Register a device","On any device with the official Tailscale client installed, point it at your Headscale instance: `tailscale up --login-server https:\u002F\u002Fvpn.yourdomain.com --authkey \u003Cyour-preauth-key>`. The device will appear in your Headscale node list within seconds: `docker exec headscale headscale nodes list`. Repeat for every device. Once registered, devices can reach each other by their mesh IP (100.x.x.x) or by magic DNS hostname.",{"title":73,"body":74},"Define access control policies","Create `\u002Fetc\u002Fheadscale\u002Facls.hujson` and reference it in `config.yaml` via `acls_path`. Headscale uses the same HuJSON ACL format as Tailscale Cloud: define groups of users, tag devices as servers or workstations, and write rules specifying which groups can reach which ports. A minimal policy allows all users to reach all nodes; tighten it by restricting access to sensitive services (databases, admin panels) to specific user groups.",{"title":76,"body":77},"Logging in for the first time","Headscale has no web interface and no account: it is the control server of your private network, driven from the command line. Over SSH: docker exec -it headscale headscale users create monuser, then headscale preauthkeys create --user monuser --reusable --expiration 24h, and connect your machines with tailscale up --login-server https:\u002F\u002F\u003Cyour-domain> --authkey \u003Ckey>.",{"type":79,"title":80,"body":81},"tip","Pair Headscale with Authelia for MFA-protected network access","Headscale handles network-layer access control (which IPs can talk to which peers), but it does not enforce application-layer authentication. Pair it with Authelia running on the same VPS: route your internal services (accessible only via the mesh) through Authelia's forward-auth layer. Users must complete MFA to access services even once they are on the mesh — defense in depth for sensitive workloads.",{"type":35,"title":83,"body":84},"Headscale vs Tailscale Cloud","Tailscale Cloud remains the easier path for small teams: no server to maintain, automatic upgrades, integrated billing. Headscale makes sense when you have more than 3 users and want to avoid per-seat costs, when data residency requires keeping network topology off third-party servers, or when you want full auditability of your coordination logs. The clients are identical — switching from Tailscale Cloud to Headscale means re-running `tailscale up --login-server` on each device, nothing more.","Deploy Headscale on your VPS in one click","Self-host your Tailscale control server with unlimited users and no cloud dependency. ServOrbit provisions a ready-to-use Headscale instance — config generated, HTTPS ready, first auth key printed in the job output.","Deploy Headscale","\u002Fvps-cloud?template=headscale",[90,106,122],{"id":91,"slug":92,"slugs":93,"title":96,"excerpt":97,"readTime":98,"views":15,"isPinned":16,"publishedAt":99,"category":100,"categories":101,"featuredImage":26,"bgImage":27,"posterImage":103,"relatedSolution":104},110,"setting-up-a-wireguard-vpn-on-your-vps",{"fr":94,"en":92,"ar":95},"vpn-wireguard-vps","إعداد-شبكة-vpn-باستخدام-wireguard-على-خادمك-vps","Setting up a WireGuard VPN on your VPS","Deploy a WireGuard VPN on your Cloud VPS: encrypted tunnel, Docker configuration and clients in a few minutes. Step-by-step guide.",3,"2026-03-02T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[102],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fvpn-wireguard-vps-poster.svg",{"categorySlug":30,"appSlug":105},"wireguard-server",{"id":107,"slug":108,"slugs":109,"title":112,"excerpt":113,"readTime":14,"views":114,"isPinned":16,"publishedAt":115,"category":116,"categories":117,"featuredImage":26,"bgImage":27,"posterImage":119,"relatedSolution":120},162,"self-host-authelia-on-a-vps-mfa-and-sso-for-your-whole-stack",{"fr":110,"en":108,"ar":111},"self-host-authelia-vps","استضافة-authelia-على-vps-مصادقة-ثنائية-ودخول-موحد-لمنظومتك","Self-Host Authelia on a VPS: MFA and SSO for Your Whole Stack","Deploy Authelia on your VPS to add MFA, SSO and fine-grained access control in front of any self-hosted app — no code changes, one configuration file.",2,"2026-07-04T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[118],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fself-host-authelia-vps-poster.svg",{"categorySlug":23,"appSlug":121},"authelia",{"id":123,"slug":124,"slugs":125,"title":128,"excerpt":129,"readTime":98,"views":15,"isPinned":16,"publishedAt":130,"category":131,"categories":132,"featuredImage":26,"bgImage":27,"posterImage":134,"relatedSolution":135},140,"openvpn-on-a-vps-private-controlled-remote-access",{"fr":126,"en":124,"ar":127},"installer-openvpn-serveur-vps","openvpn-على-خادم-vps-وصول-عن-بعد-خاص-ومضبوط","OpenVPN on a VPS: private, controlled remote access","Install OpenVPN on a VPS to secure remote access, isolate clients and keep control over your VPN profiles.","2026-02-05T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[133],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Finstaller-openvpn-serveur-vps-poster.svg",{"categorySlug":136,"appSlug":137},"securite","openvpn-server",1787581012252]