English
Headscale Hosting
Headscale is an open-source coordination server for Tailscale clients, so the control plane stays on infrastructure you administer.
- One click deploy
- 15 GB Disk Space Needed
- 1 GB RAM Memory needed
- From 2 € Price
No setup fees
Official links
Headscale’s official links and original website
- Go to Repository
Headscale GitHub
- More
Headscale Website
What you get
on AvaHost
One-click deployment, a custom domain, free HTTPS, automatic application updates, and scheduled backups come with every Cloud App. You can run multiple apps on one server, and terminal access is included.
This template does not include a database container.
Tech
- Docker image
- headscale/headscale:latest
- Default port
- 0
How Headscale works
Headscale is the open-source coordination server that Tailscale clients can use instead of Tailscale's hosted control plane. Devices still run the Tailscale client. They point at your Headscale URL. The server stores nodes, users, and pre-auth keys. The container image is headscale/headscale. Upstream's requirements page asks for a public IP, and it strongly recommends HTTPS on port 443 because the client assumes that in some cases. SQLite is the default database, with PostgreSQL as an option. This baseline keeps SQLite and does not add a separate database container.
If the embedded DERP relay is enabled, the same page says UDP 3478 must be reachable, along with TCP 443. Metrics on 9090 should stay private. A dual-stack public address is recommended by the project and is not something this plan can promise beyond the IPv4 dedicated address.
Key Headscale features
You create users and pre-auth keys, and you decide which devices may join. ACL policy is a file you maintain. MagicDNS and extra records are configured in YAML, which Headplane can edit if you add that UI later. The Docker guide mounts a config directory and a data directory for the SQLite file. Read-only root filesystems are part of the upstream example. They are compatible with a volume for /var/lib/headscale.
AvaHost updates Headscale automatically and backs up that data directory on a schedule. A bad upgrade can strand clients until the URL answers again, so check headscale health behaviour after a change by opening the health URL. A dedicated public IP is required. Application mail is not included with Headscale. Headplane is a separate app and is not installed by this package.
Headscale vs Tailscale
Headscale
Headscale lets you operate the coordination server. Tailscale lets that company operate it, with their admin console and their pricing. The client on laptops and phones is still Tailscale's client in the usual setup. Choose Tailscale when you want the hosted control plane. Choose Headscale when the requirement is to keep that database on your VPS.
Tailscale
DERP relays are the subtle part. Embedded DERP needs the UDP port. Using Tailscale's public DERP instead is an upstream option with different trust tradeoffs. This page does not claim they are identical.
Who uses Headscale
Homelabs and companies that like Tailscale clients but will not use the hosted coordination server use Headscale. It is a poor fit if you wanted a browser UI on day one and you have not also planned Headplane, and it is a poor fit if you cannot publish 443 and, for embedded DERP, UDP 3478.
Self-hosting Headscale: requirements and cost
The baseline is 512 MB of RAM and 1 CPU core, image headscale/headscale, SQLite on disk. On AvaHost the recommended minimum for Headscale is Plan 1 at €2. The package includes one-click deployment, a hostname, automated HTTPS on the coordination URL, automatic updates, and scheduled backups. This deployment requires a dedicated public IP because upstream requires a public address and, with embedded DERP, public UDP 3478. Clients must be told your server URL.
F.A.Q
Headscale starts at €2 on Plan 1. The price is the coordination server and its SQLite file, not a Headplane UI and not the Tailscale client on each device. PostgreSQL is optional upstream and is not in this minimum. A large tailnet can justify more RAM than 512 MB. DERP traffic volume is the other thing to watch.
Yes. Give clients the HTTPS URL on your hostname. Upstream prefers that URL on port 443. Automated HTTPS covers the coordination endpoint once DNS points at the dedicated address. You still enroll each device with a key or an auth flow. The hostname has to match what you put in the server config.
AvaHost updates Headscale automatically and backs up the data directory on a schedule. Read the version’s upgrade notes, because coordination servers strand clients when the schema or the URL breaks. After the update, confirm the health endpoint and that an existing node still pings. Store a copy of your ACL file if you edit it outside the data volume.
Yes. Headscale’s requirements ask for a public IP, HTTPS on 443, and UDP 3478 when the embedded DERP server is on. AvaHost requires a dedicated public IP for this package so that endpoint stays stable. The address does not write your ACL policy. Headplane, if you want a browser, is a separate deployment.