Tailscale

Tailscale is a mesh VPN built on top of WireGuard that connects your devices directly to each other over an encrypted tunnel, wherever they are. Install it on a laptop, a phone, and a home server, and all three land on the same private network with stable addresses. No port forwarding, no static IP, no manually exchanged WireGuard keys.

The part that’s open source, and the part that isn’t

Tailscale is an unusual case for a self-hosting site: most of it is open source, but the piece that isn’t is the piece doing the actual coordinating. Per Tailscale’s own open source page, the core tailscaled daemon and CLI are open source on every platform; the GUI is open too on Linux and Android, and closed on Windows, macOS, and iOS, even though the daemon underneath stays open. DERP relay servers, which help devices find each other behind strict NAT, are open source too. What stays closed is the coordination server, the piece that exchanges WireGuard keys and decides which devices can reach which. Run Tailscale normally and you’re renting that control plane from Tailscale Inc: free for personal tailnets, but closed source.

That’s exactly the gap Headscale fills.

Headscale: the fully self-hosted control server

Headscale is an independent, community-maintained reimplementation of Tailscale’s coordination server, confirmed BSD 3-Clause from the LICENSE file in juanfont/headscale on GitHub. It isn’t a Tailscale product, though one maintainer works at Tailscale and is allowed to spend work hours on it. Point standard Tailscale clients at a Headscale server instead, and everything underneath, WireGuard tunnels, NAT traversal, device authentication, keeps working the same. Tailscale’s own FAQ calls Headscale “a healthy part of the broader Tailscale ecosystem,” aimed at homelabbers and infrastructure-sovereignty use cases, an unusual thing for a VC-funded company to say about a project replacing its own service.

Installing the Tailscale client with Docker

For a homelab server already running everything else in containers, the official tailscale/tailscale image is the easy path. Unlike Headscale, this one is fully supported in Docker.

services:
  tailscale:
    image: tailscale/tailscale:stable
    container_name: tailscale
    hostname: homelab
    environment:
      - TS_AUTHKEY=tskey-auth-xxxxxxxxxxxx
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_USERSPACE=false
    volumes:
      - ./tailscale-state:/var/lib/tailscale
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
      - NET_RAW
    network_mode: host
    restart: unless-stopped

1. Generate a reusable auth key from the admin console (Settings, then Keys) so the container authenticates without an interactive login.
2. Mount a persistent volume for TS_STATE_DIR, or the node re-registers as a new device on every restart.
3. Set TS_USERSPACE to false and mount /dev/net/tun if other devices need to reach services inside this container directly.
4. Run docker compose up -d, then check status to confirm it joined the tailnet.

docker compose up -d
docker exec tailscale tailscale status

Exit nodes, subnet routers, and access control

Two features cover most of what a homelab needs from Tailscale. An exit node routes a device’s internet traffic through another tailnet member, useful on hotel wifi or to reach something only available in your home country while traveling. A subnet router does the opposite: it exposes a local subnet, a NAS, a smart TV, a printer, through one tailnet device, so Tailscale doesn’t need installing on hardware that can’t run it.

sudo tailscale set --advertise-exit-node
sudo tailscale set --advertise-routes=192.168.1.0/24

Both need approval from the admin console, or an autoApprovers rule in the policy file, before they take effect. The same file uses tags to scope access instead of trusting every device by default, and ephemeral nodes deregister themselves automatically, so a CI runner doesn’t linger as an approved device forever.

MagicDNS can also point every device at a self-hosted resolver instead of your ISP’s default, so ad-blocking follows you off the home network. Running Pi-hole or AdGuard Home as a tailnet member blocks the same trackers whether a phone is on home wifi or mobile data three states away.

Tailscale vs Headscale

	Tailscale (hosted)	Headscale (self-hosted)
Coordination server	Tailscale Inc’s, closed source	You run it, BSD 3-Clause
Typical setup time	About 5 minutes	30-60+ minutes, needs a domain and a public IP
Device limit, free tier	Generous but capped	None, it’s your own database
Admin console	Polished, hosted by Tailscale	Community web UIs like Headplane, or CLI only
Official support	Yes, a real support team	Community: Discord and GitHub issues
Best fit	Most homelabbers	No third party in the loop, at any cost

• Setup measured in minutes, not hours, and no port forwarding, ever
• NAT traversal that mostly just works, direct peer-to-peer in most conditions
• The free tier is genuinely usable for a household, not just a crippled trial

• The coordination server you get by default belongs to Tailscale Inc, not you
• Free-tier device caps count against your homelab tailnet too, family devices included
• Going fully self-hosted means running and maintaining Headscale yourself, with less polish

Remote access to a home media server is one of the most common reasons homelabbers install Tailscale. Our Jellyfin remote access guide walks through exactly that: a tailnet IP, MagicDNS, and tailscale serve for HTTPS without a separate reverse proxy.

FAQ

Is Tailscale open source?

The client is, under the BSD 3-Clause license. The coordination server it talks to by default isn’t. Headscale is the open-source alternative for that piece.

Is Tailscale free for personal use?

Yes, the free tier covers a generous number of devices per tailnet. Headscale removes any device cap, since the database is yours, at the cost of running the server.

Is Tailscale the same as WireGuard?

No. Tailscale runs on WireGuard for the encrypted tunnels, but adds the coordination layer, NAT traversal, key rotation, and access control that raw WireGuard leaves for you to configure by hand.

Can I self-host Tailscale completely?

Not Tailscale itself, its coordination server is closed source. Headscale is an independent, BSD 3-Clause reimplementation that speaks the same protocol, so standard clients connect to your own server instead.

For most homelabs, hosted Tailscale is the right start: free, fast, open source on the client end. Reach for Headscale when a third party holding your coordination server doesn’t sit right with you. Our homelab setup guide for beginners and Jellyfin remote access guide cover what comes next.