Apps / Network
Headscale
Your own Tailscale coordination server
Tailscale's control plane, self-hosted. Your devices still speak the ordinary Tailscale protocol and still connect directly to each other — but the server that decides who is on the network, and holds the keys that prove it, is this box instead of a company's. Comes with a web UI for enrolling devices and issuing pre-auth keys.
CategoryNetwork
Memory~120MB
Module
headscaleInstalling it
Open the dashboard, find it in the App Store and press Install. Or from a terminal on the box:
sudo homebox install headscaleWhere to open it
| Service | Port | First login |
|---|---|---|
| Headscale | — | — |
| Headscale UI | — | — |
| Headscale Proxy | :8091 | The web UI is at /web. It asks for an API key — make one with homebox exec headscale headscale apikeys create. |
Open it at your box's address with that port — the dashboard links to it directly once it is running.
Good to know
- The Tailscale APP is the client and this is the server. Point a client at it with
tailscale up --login-server https://your-headscale-host— the official mobile apps need a custom server set before login - Clients reach this over HTTPS with a real certificate, so it has to be published: put it behind the Proxy module or the Cloudflare Tunnel and set the URL below to that hostname
- server_url is written into every client's config when it enrols. Changing it later means every device has to log in again, so decide the hostname before you enrol anything
- config/data holds db.sqlite AND noise_private.key. The key IS this server's identity — restore both together or every device is a stranger again
- Create devices from the web UI at /web: make a pre-auth key, then run
tailscale up --login-server <url> --authkey <key>on the machine