43,400 stars · BSD-3-Clause, named in the About sidebar on 28 October 2026 · v0.29.6 (2026-10-24) · Track this in Rising ↗
A self-hosted replacement for the coordinating service behind a popular private-network tool, built for one network at a time.
Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 28 Oct 2026, the same day before this check.
Latest release v0.29.6 on 24 Oct 2026.
Public since June 2020, a little over 6 years.
45,142 stars and 2,621 forks.
364 commits and 58 new issues in the last 90 days.
270 contributors. 86 pull requests merged in 90 days.
No security policy file says how to report a problem. No published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 28 Oct 2026 from the repository on GitHub. Covered in Edition 64.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It is the piece in the middle of a private network built on WireGuard, which is the encryption technology underneath. Its job is introductions: it holds each machine's public key and hands it to the others, gives each machine an address on the private network, keeps users separate from each other, allows one user to share a machine with another, and publishes the routes a machine says it can reach. The ordinary client programs that run on each laptop, phone and server are the official ones, unchanged, pointed at this instead of at the company's service. The repository has 4,438 commits, and version v0.29.6 was published on 24 October 2026. There is a module for the NixOS distribution in the project's own tree. Three limits are stated plainly and all three matter. It is not associated with the company whose service it replaces. It is built for one private network for personal use or a small open-source organisation, so several separate networks and large-organisation features are out of scope. And the project says it does not support or encourage running it behind a reverse proxy or inside a container, which rules out the way most people's first instinct would be to deploy it.
Why it matters
Who it suits. Anyone with machines in several places who wants them on one private network, and who would rather the coordinating part not be somebody else's service. That covers a lot of people: a few rented servers, a machine at home, a couple of laptops. The honest second audience is anyone who has hit the free tier's limits on the commercial service and does not want a bill for a hobby network. Skip it if the network has to serve a real organisation with many teams, because the project says that is not what it is for, and it says so clearly enough to be believed.
Verdict. Worth an afternoon, and the warnings are unusually specific, which is a good sign about the project. The strong recommendation against reverse proxies and containers is the one to pay attention to: it is not a suggestion about taste, it is the maintainers saying that most of the problems reported to them come from exactly that. Run it directly on a small machine with a real certificate and the experience is smooth. Two more notes. It follows the commercial service's own client software, so a client update can occasionally land before support for it does. And making this the only coordinator for a network means that when it stops, machines already connected keep working but new connections do not form, so it deserves the same care as anything else that is a single point of failure. tailscale/tailscale is the client software itself, which anyone using this will also be running, and netbirdio/netbird is the alternative worth comparing if a fully self-hosted system matters more than compatibility with existing clients.
Summary (Key Points)from the README
Key features
- Control server replacement: An open source, self-hosted implementation of the Tailscale control server, aimed at self-hosters and hobbyists.
- Key exchange and addressing: Acts as the exchange point for WireGuard public keys and assigns IP addresses to clients.
- User boundaries: Creates the boundaries between users and enables sharing machines between users.
- Route advertising: Exposes the advertised routes of your nodes.
- Single-tailnet scope: Implements one Tailscale network (tailnet), suited to personal use or a small open-source organisation.
- NixOS module: A module is provided in `nix/` for NixOS users.
- Development builds: Builds from the main branch are published as container images and binaries.
- Versioned documentation: Separate documentation exists for the stable release and the development version, so you can match the docs to your release tag.
- Integration testing: The project has presented on using integration testing to reimplement Tailscale (FOSDEM 2023 talk).
Ways to install
| Platform or method | What it needs | Effort |
|---|---|---|
| Container images (development builds from main) | Not specified in the README | Not stated |
| Binaries (development builds from main) | Not specified in the README | Not stated |
| NixOS module (from `nix/`) | NixOS | Not stated |
Important
- Unsupported deployment: The maintainers state they do not support nor encourage running Headscale behind reverse proxies or in containers.
- Tag selection: Use the GitHub tag matching your released version, because the main branch may contain unreleased changes.
- Narrow scope: Headscale targets a single tailnet for personal or small organisation use, not large multi-tenant deployments.
- No affiliation: The project is not associated with Tailscale Inc., although one active maintainer is employed by Tailscale and may contribute during work hours. Other maintainers review those contributions.
- Setup details are external: Installation and running instructions are in the documentation, not in the README itself.
Written by an AI model from the project’s README; not part of the review, and it can be wrong.
- Uses the official unmodified client programs, so every platform they support is supported here.
- One compiled program with a simple configuration file, and a published package for several systems.
- States its own limits plainly, including the deployment shapes it will not help with.
- Built for one private network only, so several separate networks are out of scope by design.
- The project advises against reverse proxies and containers, which is how most people would try first.
- It follows another company's client software, so a client update can arrive before support for it.
- tailscale/tailscale
The client software this coordinates: not an alternative but the other half, running on every machine.
Track this in Rising ↗ - netbirdio/netbird
A private network system with its own clients and its own coordinator, fully self-hostable by design.
Track this in Rising ↗ - zerotier/ZeroTierOne
A different approach to the same goal, joining machines as if on one switch, with its own protocol.
Track this in Rising ↗
sudo apt install ./headscale_0.29.6_linux_amd64.deb
