{
 "slug": "headscale",
 "name": "Headscale",
 "tagline": "Self-hosted coordination server for Tailscale clients on a private WireGuard mesh",
 "category": "networking",
 "use_cases": [
  "mesh-vpn",
  "tailscale-compatible",
  "zero-trust-networking"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "juanfont",
  "url": "https://headscale.net",
  "license": "BSD-3-Clause",
  "license_url": "https://github.com/juanfont/headscale/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   8080,
   9090
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "0.29.6",
   "last_build": "2026-10-25",
   "entity_id": "prod-przu65jbhgd3m",
   "ami_alias": "/aws/service/marketplace/prod-przu65jbhgd3m/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-zdorb6ds4jdmu",
   "recommended_instance_type": "t3.small",
   "price_usd_per_hour": 0.03,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "0.29.4",
   "last_build": "2026-10-03",
   "offer_id": "headscale",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:headscale:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.headscale?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/headscale/",
  "json": "https://lynxroute.com/products/headscale/product.json"
 },
 "release_notes": [
  {
   "version": "0.29.6",
   "title": "Headscale 0.29.6",
   "notes": "* Headscale updated 0.29.5 -> 0.29.6, a security and patch release. BSD-3-Clause unchanged; minimum supported Tailscale client remains v1.80.0\n* Security: built with Go 1.27.3 to reject certificate chains containing the compromised eMudhra intermediate keys (CVE-2026-111943), plus golang.org/x/net, x/text and gRPC updates for HTTP/2 denial-of-service fixes\n* Faster peer-map construction on large tailnets and clean stream shutdown when a node logs out\n* Each instance generates its own control-server Noise private key at first boot\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-25"
   }
  },
  {
   "version": "0.29.5",
   "title": "Headscale 0.29.5",
   "notes": "* Headscale updated 0.29.4 -> 0.29.5, a bugfix release. BSD-3-Clause unchanged; minimum supported Tailscale client remains v1.80.0\n* Security: SSH access is revoked as soon as its policy rules are removed, reused SSH-check verdicts are rejected, and clients no longer upload logs when logtail is disabled\n* Each instance generates its own control-server Noise private key at first boot\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-23"
   }
  },
  {
   "version": "0.29.4",
   "title": "Headscale v0.29.4",
   "notes": "* Security: each instance now generates its own control-server Noise private key at first boot. Earlier images, including the first 0.29.4 release, shipped a key created during the image build, shared by every instance launched from that image. Existing deployments should rotate it: sudo systemctl stop headscale && sudo rm /var/lib/headscale/noise_private.key && sudo systemctl start headscale (clients reconnect automatically)\n* Headscale updated 0.29.3 -> 0.29.4. BSD-3-Clause unchanged; minimum supported Tailscale client remains v1.80.0\n* Fixes deleted nodes staying connected and expired nodes staying online, so removal and key expiry now take effect immediately\n* Exit nodes are offered again to recent macOS and iOS clients, and a fix stops the Android app crashing on its device list\n* Hardened OIDC login (single-use callback state, reload-safe confirmation page) and ACME certificate renewal no longer stops after a transient error\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-03"
   }
  },
  {
   "version": "0.29.4",
   "title": "Headscale 0.29.4",
   "notes": "* Headscale updated 0.29.3 -> 0.29.4. BSD-3-Clause unchanged; minimum supported Tailscale client remains v1.80.0\n* Fixes deleted nodes staying connected and expired nodes staying online, so removal and key expiry now take effect immediately\n* Exit nodes are offered again to recent macOS and iOS clients, and a fix stops the Android app crashing on its device list\n* Hardened OIDC login (single-use callback state, reload-safe confirmation page) and ACME certificate renewal no longer stops after a transient error\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-03"
   }
  },
  {
   "version": "0.29.3",
   "title": "Headscale v0.29.3",
   "notes": "* Re-release of Headscale 0.29.3. The application version is unchanged; this build refreshes the underlying operating system image\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-03",
    "azure": "2026-08-18"
   }
  },
  {
   "version": "0.29.2",
   "title": "Headscale 0.29.2 (July 2026)",
   "notes": "* Headscale 0.29.2 on Ubuntu 24.04 LTS - minor update from 0.28.0\n* Automatic forward-only database migration on start (node-expiry backfill)\n* Shipped configuration unaffected by the removed keys\n* Minimum Tailscale client raised to v1.80.0 (buyer-side)\n* BSD-3-Clause license unchanged\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-20",
    "azure": "2026-07-11"
   }
  },
  {
   "version": "0.28.0",
   "title": "Headscale 0.28.0 - Initial release (May 2026)",
   "notes": "* Headscale 0.28.0 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Noise protocol private key generated per instance at first boot\n* Default user and reusable 24-hour pre-auth key created at first boot\n* gRPC API and Prometheus metrics bound to 127.0.0.1 only\n* UFW firewall pre-configured (TCP 8080 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-05-07",
    "azure": "2026-06-10"
   }
  }
 ],
 "release_history": [
  {
   "version": "0.29.6",
   "aws": "2026-10-25"
  },
  {
   "version": "0.29.5",
   "aws": "2026-10-23"
  },
  {
   "version": "0.29.4",
   "aws": "2026-10-02",
   "azure": "2026-10-03"
  },
  {
   "version": "0.29.3",
   "aws": "2026-09-03",
   "azure": "2026-08-18"
  },
  {
   "version": "0.29.2",
   "aws": "2026-07-20",
   "azure": "2026-07-11"
  },
  {
   "version": "0.28.0",
   "aws": "2026-05-07",
   "azure": "2026-06-10"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-przu65jbhgd3m/latest \\\n  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer headscale --plan payg-gen2\naz vm create -g my-rg -n headscale --size Standard_D2s_v3 \\\n  --image lynxroute:headscale:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Headscale is an open-source, self-hosted implementation of the Tailscale coordination server. It speaks the same control protocol as Tailscale's hosted SaaS, so any standard tailscale client (Linux, macOS, Windows, iOS, Android) can register against it and join a private WireGuard-based mesh VPN.\n\nBy running your own control plane you keep node metadata, auth flows, and ACL evaluation inside your own AWS account - none of it transits controlplane.tailscale.com. Headscale supports MagicDNS, ACLs, pre-auth keys, ephemeral nodes, route advertisement, and tag-based authorization. BSD-3-Clause license, written in Go, single statically linked binary.",
  "image_adds": "Security hardening:\n* Noise protocol private key generated per instance at first boot - never reused across deployments\n* Default user and reusable 24-hour pre-auth key created automatically at first boot - operator runs `tailscale up` and is on the network\n* gRPC API and Prometheus metrics bound to 127.0.0.1 only - never reachable from outside the instance\n* UFW firewall pre-configured - only the Tailscale endpoint (TCP 8080) is exposed; SSH on 22 only\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}