What's installed on your Headscale server?
- Headscale 0.29.7 from the official Docker image, BSD-3 licensed
- HTTPS through Caddy, with the server address on sslip.io, so a domain is optional
- SQLite database and the official example configuration, with only the address fields changed
- A user called yonetici and a reusable connection key valid for one year
- MagicDNS turned on, so devices reach each other by name under tailnet.internal
- Firewall with only ports 22, 80 and 443 open
What size do you need for Headscale?
Headscale's official docs don't give a RAM figure or a device limit. It covers a single network and is written for personal use or a small community. As a rule of thumb, 1 GB is enough for a few devices, and 2 GB suits many of them. Headscale only introduces devices to each other, and most traffic goes directly between them, so a big size is rarely needed. If it isn't enough, scale RAM and CPU up from your panel, and your address stays the same.
| Use | Size | Price | Choose |
|---|---|---|---|
| A few devices | 1 GB RAM · 1 vCore · 25 GB NVMe | $2.58/mo | |
| The whole family | 2 GB RAM · 1 vCore · 40 GB NVMe | $4.01/mo | |
| The whole team | 4 GB RAM · 2 vCore · 60 GB NVMe | $6.89/mo |
Who is it for?
- Anyone who wants their computer, phone and home server on one private network
- People who like the Tailscale client but want to keep the control server themselves
- Personal setups and small open-source communities
- Anyone who wants to reach remote devices as if they were on the same local network
What happens after you order?
- Set the size and complete your payment. Your server starts and Headscale installs itself.
- In your panel, open your server from My servers and copy the Site address and Admin key values from the Overview tab.
- Install the official Tailscale client on the device you want to connect.
- On the device, run: tailscale up --login-server SITE-ADDRESS --authkey ADMIN-KEY
- To see your devices, connect over SSH and run docker compose exec headscale headscale nodes list in /opt/seturack/headscale.
With every server
- Daily backups included in the price
- Unlimited traffic
- Full root access
- Scale RAM and CPU up or down later, and grow the disk
- Location: Istanbul · IST-1.
Good to know
- The Admin key is reusable, so anyone who has it can add devices to your network. Don't share it.
- If a direct connection can't be made, traffic passes encrypted through Tailscale's public DERP relays. To run your own relay, enable the embedded DERP server, which also needs port 3478/UDP.
- Devices connect to the server address. If you want your own domain, set it up before connecting the first device, and change server_url in the configuration too.
- Headscale isn't associated with Tailscale Inc. It aims to support the last 10 releases of the Tailscale client on each platform.
- If a certificate can't be issued, the address uses http. The official docs require HTTPS on port 443 for clients, so connect your own domain in that case.
Headscale questions and answers
How much RAM does Headscale need?
Headscale's official docs don't give a RAM figure. As a rule of thumb, 1 GB is enough for a few devices, and 2 GB suits many of them. The load is low because Headscale only introduces devices to each other.
How do I connect a device to Headscale?
Install the official Tailscale client, then run tailscale up with your panel's Site address after --login-server and your Admin key after --authkey. You can use the same key on every device.
Can I connect a phone to Headscale?
Yes, Headscale supports Android and iOS too. On Android, open Accounts in the Tailscale app, enter your address under Use an alternate server and your key under Use an auth key. The steps for Apple devices are on your server's /apple page.
Does my internet traffic leave through the Headscale server?
No. Headscale introduces devices to each other, and traffic flows between them. For internet exit, you can make one device on your network an exit node. If you want traffic to leave through your own server, look at the server with WireGuard installed.
Does Headscale have a web panel?
No. In Headscale, devices and keys are managed with commands on the server. Connect over SSH, use nodes list to see your devices and preauthkeys create to generate a new key.
What happens when my Headscale key expires?
The key created during install is valid for one year. To keep adding devices after that, connect over SSH and generate a new one with the headscale preauthkeys create command.