5 ms·

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. ht

I can only recommend giving headscale a try. It's free, works extremely well, and can be used with the official Tailscale clients. Was super easy to set up. https://headscale.net/stable/ https://headscale.net/stable/

db04 9mo ago
Is Headscale suitable for production use?
- tucnak 9mo ago
  No, it's only viable if your whole network is, like, five devices.
  - protimewaster 9mo ago
    I assume this is an exaggeration? Another poster says they have good luck with headscale on two networks of 400 devices.
    - mittermayr 9mo ago
      yeah looks like someone is either a hyper tailscale fan or had extremely bad experience with it, I also run several dozens of machines (and tablets and phones) on it. never had a single moment of downtime since I started.
- linsomniac 9mo ago
  I'd say no, but it really depends on what your use is. The biggest barrier is that it doesn't have a HA story that I'm aware of, but you might be able to get one by carefully replicating the sqlite and using something like pacemaker to fail over and fail back. That said, I've been using headscale on 220 devices for ~3.5 years now and it's been quite reliable.
markonen 9mo ago
Apparently they've deprecated Postgres support and now only recommend sqlite as the storage backend. I have nothing against sqlite but to me this looks like Tailscale actively signaling what they think the expected use of headscale is.
- athrowaway3z 9mo ago
  I dont understand what these two have to do with anything? The db-use is almost trivial, and SQLite can be embedded. Why would we want wasted effort and configuration complexity on supporting postgres?
  - flammafex 9mo ago
    [flagged]
    - prmoustache 9mo ago
      With that kind of logic you wouldn't need headscale and would just ask your favorite LLM to write a similar tool for your with your own requirements and nothing else.
      - flammafex 9mo ago
        No, not really necessary to extrapolate the logic any further. You have deemed a very specific and focused task as "wasted effort." So the logic leads to putting in the effort you do not find "wasteful" and outsource the remainder to the LLM do this very specific thing.
- ghrl 9mo ago
  https://headscale.net/stable/about/faq/#scaling-how-many-clients-does-headscale-support https://headscale.net/stable/about/faq/#scaling-how-many-cli... > Scaling / How many clients does Headscale support? > It depends. As often stated, Headscale is not enterprise software and our focus is homelabbers and self-hosters. Of course, we do not prevent people from using it in a commercial/professional setting and often get questions about scaling. > Please note that when Headscale is developed, performance is not part of the consideration as the main audience is considered to be users with a modest amount of devices. We focus on correctness and feature parity with Tailscale SaaS over time. [...] > Headscale calculates a map of all nodes that need to talk to each other, creating this "world map" requires a lot of CPU time. When an event that requires changes to this map happens, the whole "world" is recalculated, and a new "world map" is created for every node in the network. [...] > Headscale will start to struggle when [there are] e.g. many nodes with frequent changes will cause the resource usage to remain constantly high. In the worst case scenario, the queue of nodes waiting for their map will grow to a point where Headscale never will be able to catch up, and nodes will never learn about the current state of the world. I find that quite interesting and it is one of the reasons I've not really considered trying out Headscale myself.
mstaoru 9mo ago
Headscale is good. We're using to manage a two isolated networks of about 400 devices each. It just works. It's in China so official Tailscale DERPs do not work, but enabling built-in DERP was very easy.
FazJaxton 9mo ago
Could you give a brief description of your use case? I'm looking at all the tailscale buzzwords on their site, but am not really understanding what I would use this for in my home setup
- rpastuszak 9mo ago
  Not sure about the parent, but here's what I use it for: A) easy access my other, older machines from my phone or work laptop to: - self-host a Coolify server (a "vercel-lite" control panel) - remote connect to my older laptop to run tests/longer coding tasks for work (e.g. large browser test suites, sandboxed claude running in bg to answer longer code questions, or build fire and forget spikes/experiments) - control my home cinema remotely (remote+ app bc it's easy and Remote Desktop). - use w. Mullvad VPN as an exit note (Tailscale has a really easy UI for it nowadays) B) use it like ngrok to expose my dev servers to the internet (e.g. when sharing a quick demo/pairing with a coworker) C) cheap NAS - I the old mac is connected to an external HD (the HD itself is archived to Hetzner) I haven't (yet) tested it as an alternative to Hamachi (is it still a thing?) but I'm planing a LAN party with my brothers who live across the continent. Like you, I also didn't know what the fuss was about, and I'm generally cautious not to get sidetracked.
  - slumberlust 9mo ago
    Hamachi is still a thing, but LMI enshitified a decade ago.
  - esseph 9mo ago
    Hamachi is layer2 (like zerotier) Wireguard, talescale, netbird, etc. are layer 3.
    - rpastuszak 9mo ago
      Ah, correct, https://devilutionx.com https://devilutionx.com uses it for that specific reason.
- ErneX 9mo ago
rpastuszak 9mo ago
Any luck using with with a VPN like Mullvad as an exit node?
- SparkyMcUnicorn 9mo ago
  I've done this a few different ways. I started with a docker container that connected to both the VPN provider and tailscale. Now OPNSense is handing a few connections to the VPN provider at a couple locations around the world, and enforcing external traffic to be routed to the VPN connections via VLAN tags (untagged has direct internet access). Using the VPN provider can either be adding a VLAN tag to a machine/container or connecting to a "vpn-{location}" tailscale exit node.
colordrops 9mo ago
Headscale mostly works pretty well but its pretty finicky to get set up in a way where the tailscale clients on linux and android aren't always complaining with warnings or having route or DNS issues. I'm considering investigating one of these non commericial solutions where the entire stack was built to work together.
xyst 9mo ago
headscale is an awesome project. And I love tailscale as a product. But this is where netbird beats tailscale: coordinator server open sourced out/self hosted out the gate. Headscale is currently maintained by a few tailscale employees on their spare time. Currently, Tailscale allows this to happen but clearly there’s some internal management of what gets downstreamed to headscale. What I don’t like about headscale is that you can only host a single coordinator server as well. If I need to do maintenance on the server, it means an impact to the tailnet. It’s rare but annoying.
- hamandcheese 9mo ago
  > What I don’t like about headscale is that you can only host a single coordinator server as well. If I need to do maintenance on the server, it means an impact to the tailnet. It’s rare but annoying. Any p2p connections should keep working for some time even if the coordinator goes down... right?
  - redeeman 9mo ago
    can confirm that connections do not die while taking the coordinator down during update (not long time, but still)
h4kunamata 9mo ago
According to its own documentation: https://headscale.net/stable/setup/requirements/ https://headscale.net/stable/setup/requirements/ So instead of opening a port on my firewall for WireGuard, I must have these ports public exposed: * tcp/80 * tcp/443 * udp/3478 * tcp/50443 I don't know about you but that seems the most insane approach. Even if HTTP-01 challenge is not used, you are still exposing 3 ports instead of 1 random-high port like 55555 for example. Yeah yeah, you can use rever-proxy but still, you are exposing way more ports and services to the internet than just one port for WireGuard itself.
- catlifeonmars 9mo ago
  Read the docs more closely. - TCP/80 is only required to answer let’s encrypt challenges for certificate issuance - UDP is only required to enable DERP. These are both optional. It’s not surprising that there are additional ports required on top of Wireguard. 443 is likely for key distribution and management. If you don’t want PKI then you don’t need headscale; you can always distribute the keys yourself and just run plain wireguard
  - h4kunamata 9mo ago
    >If you don’t want PKI then you don’t need headscale; you can always distribute the keys yourself and just run plain wireguard It makes more sense to me, WireGuard + SPA (fkwnop aka replacement of port knocking that requires pre-shared key to even talk with, only that IP can access to it (IP Table), any scan tool seems it as closed) Headscale/Tailscale only has value if you are behind a CGNAT, otherwise, it just adds extra management and complexities.
    - catlifeonmars 9mo ago
      Well, it also lets you federate access and manages the keys for you. But yeah, if it’s a personal setup and you have good key rotation hygiene, I agree with you: it doesn’t add much value on top of wireguard. I’ll hazard a guess that you can just run your own DERP relay too for the CGNAT case.
- 9mo ago

db04 9mo ago

Is Headscale suitable for production use?

tucnak 9mo ago
No, it's only viable if your whole network is, like, five devices.
- protimewaster 9mo ago
  I assume this is an exaggeration? Another poster says they have good luck with headscale on two networks of 400 devices.
  - mittermayr 9mo ago
    yeah looks like someone is either a hyper tailscale fan or had extremely bad experience with it, I also run several dozens of machines (and tablets and phones) on it. never had a single moment of downtime since I started.
linsomniac 9mo ago
I'd say no, but it really depends on what your use is. The biggest barrier is that it doesn't have a HA story that I'm aware of, but you might be able to get one by carefully replicating the sqlite and using something like pacemaker to fail over and fail back. That said, I've been using headscale on 220 devices for ~3.5 years now and it's been quite reliable.

markonen 9mo ago

Apparently they've deprecated Postgres support and now only recommend sqlite as the storage backend. I have nothing against sqlite but to me this looks like Tailscale actively signaling what they think the expected use of headscale is.

athrowaway3z 9mo ago
I dont understand what these two have to do with anything? The db-use is almost trivial, and SQLite can be embedded. Why would we want wasted effort and configuration complexity on supporting postgres?
- flammafex 9mo ago
  [flagged]
  - prmoustache 9mo ago
    With that kind of logic you wouldn't need headscale and would just ask your favorite LLM to write a similar tool for your with your own requirements and nothing else.
    - flammafex 9mo ago
      No, not really necessary to extrapolate the logic any further. You have deemed a very specific and focused task as "wasted effort." So the logic leads to putting in the effort you do not find "wasteful" and outsource the remainder to the LLM do this very specific thing.
ghrl 9mo ago
https://headscale.net/stable/about/faq/#scaling-how-many-clients-does-headscale-support https://headscale.net/stable/about/faq/#scaling-how-many-cli... > Scaling / How many clients does Headscale support? > It depends. As often stated, Headscale is not enterprise software and our focus is homelabbers and self-hosters. Of course, we do not prevent people from using it in a commercial/professional setting and often get questions about scaling. > Please note that when Headscale is developed, performance is not part of the consideration as the main audience is considered to be users with a modest amount of devices. We focus on correctness and feature parity with Tailscale SaaS over time. [...] > Headscale calculates a map of all nodes that need to talk to each other, creating this "world map" requires a lot of CPU time. When an event that requires changes to this map happens, the whole "world" is recalculated, and a new "world map" is created for every node in the network. [...] > Headscale will start to struggle when [there are] e.g. many nodes with frequent changes will cause the resource usage to remain constantly high. In the worst case scenario, the queue of nodes waiting for their map will grow to a point where Headscale never will be able to catch up, and nodes will never learn about the current state of the world. I find that quite interesting and it is one of the reasons I've not really considered trying out Headscale myself.

mstaoru 9mo ago

Headscale is good. We're using to manage a two isolated networks of about 400 devices each. It just works. It's in China so official Tailscale DERPs do not work, but enabling built-in DERP was very easy.

FazJaxton 9mo ago

Could you give a brief description of your use case? I'm looking at all the tailscale buzzwords on their site, but am not really understanding what I would use this for in my home setup

rpastuszak 9mo ago
Not sure about the parent, but here's what I use it for: A) easy access my other, older machines from my phone or work laptop to: - self-host a Coolify server (a "vercel-lite" control panel) - remote connect to my older laptop to run tests/longer coding tasks for work (e.g. large browser test suites, sandboxed claude running in bg to answer longer code questions, or build fire and forget spikes/experiments) - control my home cinema remotely (remote+ app bc it's easy and Remote Desktop). - use w. Mullvad VPN as an exit note (Tailscale has a really easy UI for it nowadays) B) use it like ngrok to expose my dev servers to the internet (e.g. when sharing a quick demo/pairing with a coworker) C) cheap NAS - I the old mac is connected to an external HD (the HD itself is archived to Hetzner) I haven't (yet) tested it as an alternative to Hamachi (is it still a thing?) but I'm planing a LAN party with my brothers who live across the continent. Like you, I also didn't know what the fuss was about, and I'm generally cautious not to get sidetracked.
- slumberlust 9mo ago
  Hamachi is still a thing, but LMI enshitified a decade ago.
- esseph 9mo ago
  Hamachi is layer2 (like zerotier) Wireguard, talescale, netbird, etc. are layer 3.
  - rpastuszak 9mo ago
    Ah, correct, https://devilutionx.com https://devilutionx.com uses it for that specific reason.
ErneX 9mo ago

rpastuszak 9mo ago

Any luck using with with a VPN like Mullvad as an exit node?

SparkyMcUnicorn 9mo ago
I've done this a few different ways. I started with a docker container that connected to both the VPN provider and tailscale. Now OPNSense is handing a few connections to the VPN provider at a couple locations around the world, and enforcing external traffic to be routed to the VPN connections via VLAN tags (untagged has direct internet access). Using the VPN provider can either be adding a VLAN tag to a machine/container or connecting to a "vpn-{location}" tailscale exit node.

colordrops 9mo ago

Headscale mostly works pretty well but its pretty finicky to get set up in a way where the tailscale clients on linux and android aren't always complaining with warnings or having route or DNS issues. I'm considering investigating one of these non commericial solutions where the entire stack was built to work together.

xyst 9mo ago

headscale is an awesome project. And I love tailscale as a product. But this is where netbird beats tailscale: coordinator server open sourced out/self hosted out the gate. Headscale is currently maintained by a few tailscale employees on their spare time. Currently, Tailscale allows this to happen but clearly there’s some internal management of what gets downstreamed to headscale. What I don’t like about headscale is that you can only host a single coordinator server as well. If I need to do maintenance on the server, it means an impact to the tailnet. It’s rare but annoying.

hamandcheese 9mo ago
> What I don’t like about headscale is that you can only host a single coordinator server as well. If I need to do maintenance on the server, it means an impact to the tailnet. It’s rare but annoying. Any p2p connections should keep working for some time even if the coordinator goes down... right?
- redeeman 9mo ago
  can confirm that connections do not die while taking the coordinator down during update (not long time, but still)

h4kunamata 9mo ago

According to its own documentation: https://headscale.net/stable/setup/requirements/ https://headscale.net/stable/setup/requirements/ So instead of opening a port on my firewall for WireGuard, I must have these ports public exposed: * tcp/80 * tcp/443 * udp/3478 * tcp/50443 I don't know about you but that seems the most insane approach. Even if HTTP-01 challenge is not used, you are still exposing 3 ports instead of 1 random-high port like 55555 for example. Yeah yeah, you can use rever-proxy but still, you are exposing way more ports and services to the internet than just one port for WireGuard itself.

catlifeonmars 9mo ago
Read the docs more closely. - TCP/80 is only required to answer let’s encrypt challenges for certificate issuance - UDP is only required to enable DERP. These are both optional. It’s not surprising that there are additional ports required on top of Wireguard. 443 is likely for key distribution and management. If you don’t want PKI then you don’t need headscale; you can always distribute the keys yourself and just run plain wireguard
- h4kunamata 9mo ago
  >If you don’t want PKI then you don’t need headscale; you can always distribute the keys yourself and just run plain wireguard It makes more sense to me, WireGuard + SPA (fkwnop aka replacement of port knocking that requires pre-shared key to even talk with, only that IP can access to it (IP Table), any scan tool seems it as closed) Headscale/Tailscale only has value if you are behind a CGNAT, otherwise, it just adds extra management and complexities.
  - catlifeonmars 9mo ago
    Well, it also lets you federate access and manages the keys for you. But yeah, if it’s a personal setup and you have good key rotation hygiene, I agree with you: it doesn’t add much value on top of wireguard. I’ll hazard a guess that you can just run your own DERP relay too for the CGNAT case.
9mo ago