Catalog / Networking & remote access

Headscale

Self-hosted coordination server for Tailscale clients on a private WireGuard mesh

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace0.29.6↗ Azure Marketplace0.29.4↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
0.29.6$0.03/hr
Recommended instance: t3.small · 5-day free trial
2026-10-25Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
0.29.4$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-03Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseBSD-3-Clause
Upstreamjuanfont
Machine-readableproduct.json · catalog.json
What is Headscale

Headscale is an open-source, self-hosted implementation of the Tailscale coordination server. It speaks the same control protocol as Tailscale's hosted SaaS, so any standard tailscale client (Linux, macOS, Windows, iOS, Android) can register against it and join a private WireGuard-based mesh VPN.

By running your own control plane you keep node metadata, auth flows, and ACL evaluation inside your own AWS account - none of it transits controlplane.tailscale.com. Headscale supports MagicDNS, ACLs, pre-auth keys, ephemeral nodes, route advertisement, and tag-based authorization. BSD-3-Clause license, written in Go, single statically linked binary.

What the Lynxroute image adds

Security hardening:

  • Noise protocol private key generated per instance at first boot - never reused across deployments
  • Default user and reusable 24-hour pre-auth key created automatically at first boot - operator runs `tailscale up` and is on the network
  • gRPC API and Prometheus metrics bound to 127.0.0.1 only - never reachable from outside the instance
  • UFW firewall pre-configured - only the Tailscale endpoint (TCP 8080) is exposed; SSH on 22 only
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/headscale-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-przu65jbhgd3m/latest \
  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer headscale --plan payg-gen2
az vm create -g my-rg -n headscale --size Standard_D2s_v3 \
  --image lynxroute:headscale:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Headscale 0.29.6

AWS · 2026-10-25
  • Headscale updated 0.29.5 -> 0.29.6, a security and patch release. BSD-3-Clause unchanged; minimum supported Tailscale client remains v1.80.0
  • Security: built with Go 1.27.3 to reject certificate chains containing the compromised eMudhra intermediate keys (CVE-2026-111943), plus golang.org/x/net, x/text and gRPC updates for HTTP/2 denial-of-service fixes
  • Faster peer-map construction on large tailnets and clean stream shutdown when a node logs out
  • Each instance generates its own control-server Noise private key at first boot
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build