juanfont/headscale

Headscale is an open-source, self-hosted replacement for the Tailscale coordination server, written in Go. To understand what that means, some context helps: Tailscale is a modern VPN (virtual private network) that uses WireGuard, a fast, secure tunneling protocol, to connect your devices into a private mesh network. Your phones, laptops, servers, and cloud machines can all reach each other as if they were on the same local network, even behind firewalls and NAT (Network Address Translation, the mechanism that lets many devices share one public IP address). Tailscale handles this seamlessly, but one piece of it, the control server that manages encryption keys, assigns IP addresses, and keeps track of which devices belong to which network, is proprietary and hosted by Tailscale Inc. Headscale reimplements that control server so you can run it yourself on your own hardware. Your devices still use the standard, open-source Tailscale client software, but instead of phoning home to Tailscale's cloud, they register with your self-hosted Headscale instance. This gives you full control over your network configuration and avoids any dependency on a third-party service. You would use Headscale when you want a Tailscale-style private mesh network but need it to be entirely self-contained, for a home lab, a small organisation, or any situation where sending device metadata to an external server is undesirable. It is designed for personal use or small teams, not enterprise-scale deployments. The tech stack is Go, with Protobuf-defined APIs. It supports NixOS as a first-class deployment target and ships binary builds as well. Contributors need Go and the Buf Protobuf code generator.