Skip to content
Sign up Log in
One-click app

Headscale Server

Your private mesh VPN with its own control server: Headscale connects your devices through the Tailscale clients – installed with one click in the panel, on your domain with HTTPS.

Choose Package Configure Server

Monthly cancellable · no setup fee · prepaid

Recommended spec

The optimal configuration

Our recommendation for Headscale: the cheapest package with the right resources – no minimum term.

1
CPU Cores
AMD EPYC vCores
4GB
Memory
DDR4 ECC
20GB
NVMe Storage
NVMe SSD · Ceph HA
4,99€
Price
Monthly

Minimum requirements of Headscale (below them the panel refuses the install): 256 MB RAM · 5 GB NVMe

In Detail

Why Headscale on Your Own Server?

With Tailscale, the provider normally manages which devices belong to your network. With Headscale that control sits on your server: you manage devices, keys and users yourself, without an account with any service.

Headscale is an independent open-source implementation of the Tailscale control server. Your devices use the regular Tailscale clients but register with your server and build direct WireGuard-encrypted connections between each other. Because the clients need a fixed HTTPS address, you enter a domain pointing to your server during the install; it cannot be changed afterwards. The panel sets up Headscale with SQLite, MagicDNS and a first user and obtains the HTTPS certificate from Let’s Encrypt. There is no web interface: you register devices with a pre-auth key that you create via SSH with the headscale command. If two devices cannot connect directly, their still end-to-end encrypted traffic is relayed through Tailscale’s public DERP relays. Headscale is very frugal – 256 MB of RAM is enough.

  • DDoS Protection
  • Location — Frankfurt DE-CIX
  • Storage — NVMe Ceph HA

Features

All Benefits at a Glance

Full root access — install anything

Install any software, any runtime, any version — no restrictions from panels or shared hosting.

NVMe SSD Ceph HA storage

High-performance NVMe SSDs in a Ceph HA cluster for maximum I/O performance and 3x redundancy.

Enterprise DDoS protection included

Permanent protection with high-capacity filtering — included free with every server.

Full SSH root access

Connect anytime via SSH and manage your server with full administrator privileges.

VXLAN private networks

Connect multiple servers in an isolated VXLAN Layer 2 network — separated from the internet and without public IPs.

Runs continuously — no sleep mode

No sleep mode and no shutdown when idle: your server keeps running as long as its term is paid.

Always included

Included with every root server

Enterprise DDoS protection included Full root access — install anything NVMe SSD Ceph HA storage Runs continuously — no sleep mode Low latency — Frankfurt DE-CIX 1× IPv4 + /64 IPv6

All Root Server Packages

Choose the package that best fits your project

Every one of these packages meets the minimum requirements of Headscale.

RootPaket-1

Recommended

4,99€ Monthly

  • 1 AMD EPYC vCores
  • 4 GB DDR4 RAM
  • 20 GB NVMe SSD
  • 1× IPv4 + /64 IPv6
  • DDoS Protection Included
View Packages

RootPaket-2

5,99€ Monthly

  • 2 AMD EPYC vCores
  • 6 GB DDR4 RAM
  • 50 GB NVMe SSD
  • 1× IPv4 + /64 IPv6
  • DDoS Protection Included
View Packages

RootPaket-3

9,99€ Monthly

  • 4 AMD EPYC vCores
  • 16 GB DDR4 RAM
  • 80 GB NVMe SSD
  • 1× IPv4 + /64 IPv6
  • DDoS Protection Included
View Packages

RootPaket-4

19,69€ Monthly

  • 6 AMD EPYC vCores
  • 24 GB DDR4 RAM
  • 130 GB NVMe SSD
  • 1× IPv4 + /64 IPv6
  • DDoS Protection Included
View Packages

RootPaket-5

30,49€ Monthly

  • 8 AMD EPYC vCores
  • 32 GB DDR4 RAM
  • 180 GB NVMe SSD
  • 1× IPv4 + /64 IPv6
  • DDoS Protection Included
View Packages

RootPaket-6

46,79€ Monthly

  • 8 AMD EPYC vCores
  • 48 GB DDR4 RAM
  • 200 GB NVMe SSD
  • 1× IPv4 + /64 IPv6
  • DDoS Protection Included
View Packages

Get Started in 3 Steps

Get Started in 3 Steps

1

Order a root server and point a domain to its IP

2

Pick Headscale under “Apps” in the panel, enter a domain, install

3

Create a pre-auth key via SSH and register your first device with the Tailscale client

  • Own domain with HTTPS (Let’s Encrypt) possible
  • The install usually takes about 2 minutes
  • Runs on Ubuntu, Debian, AlmaLinux and Rocky Linux

More one-click apps: Vaultwarden · Nginx Proxy Manager · authentik · WireGuard (wg-easy) · WordPress · Nextcloud · Coolify · Open WebUI + Ollama · Jellyfin · Forgejo / Gitea

Frequently Asked Questions

Answers to the most important questions

Which devices can I connect?
Anything with a Tailscale client, such as Linux, Windows, macOS, Android and iOS. In the client you set your server as the login server, on Linux for example with tailscale up --login-server https://your-domain.
Is Headscale a Tailscale product?
No. Headscale is an independent open-source project that is compatible with the Tailscale clients. It does not replicate every feature of the commercial service.
Is there a web interface?
Headscale itself is run from the command line, via SSH with docker exec and the headscale command. With root access you can add a third-party web interface yourself if you want one.
Does my traffic go through my server?
No, your server only coordinates. Devices connect to each other directly where possible; if that fails, Tailscale’s public DERP relays pass on the encrypted traffic.

Get Started Now

Your mesh VPN with its own control server – from €4.99 a month.

Choose Package Configure Server