Headscale on AWS - Your Own Tailscale Control Plane, No Per-Device Bill
Tailscale is good software. It turns WireGuard into something you can actually run day to day - no manual key exchange, it gets through NAT without you thinking about it, and there's a real admin UI instead of a config file you're scared to touch. What a lot of teams don't love is that every device counts, and the control plane, the part that knows who's on your network and how to route between them, lives on Tailscale's servers, not yours.
Meetrix packaged Headscale, the open-source, self-hosted reimplementation of that exact control server, into an AWS Marketplace AMI. Same devices. Same official Tailscale client apps everyone already knows. The difference is the coordination layer runs inside your own AWS account instead of someone else's cloud. Ready to try it? Launch the Meetrix Headscale AMI on AWS Marketplace.
What is Headscale?
Headscale is an open-source implementation of the Tailscale control server. Devices still run the standard Tailscale client - nobody on your team has to install anything unfamiliar - but instead of registering with Tailscale's hosted coordination service, they register with a Headscale server you run yourself. WireGuard still does the actual encrypting of traffic between devices. Headscale's job is simpler than people expect: it just keeps the map of who's on the network and who's allowed to talk to whom.
This AMI also bundles Headplane, a web-based admin panel, on top of the Headscale server itself. That matters more than it sounds like it should. Running Headscale on your own usually means managing users, devices, and access rules entirely from the command line, and that's the part that stops most teams from bothering. With Headplane already wired in, you get a dashboard from the first login instead of a terminal and a man page.
What Counts as a 'User' on a Hosted Mesh VPN?
How Deployment Works
Setting up Headscale by hand means building the server, wiring up a database, configuring a reverse proxy, and bolting on an admin UI separately, if you want one at all. Through the Marketplace, it's four steps:
- Launch from AWS Marketplace Open the Meetrix Headscale listing, subscribe, and choose the CloudFormation deployment path. Headscale and Headplane ship pre-installed and already talking to each other.
- Point Your Domain Add a DNS A record pointing your domain at the instance's public IP. If your domain is hosted on Route 53, the stack attempts to issue SSL automatically once it resolves.
- SSL Issues Automatically (With a Manual Fallback) Most deployments get a working certificate without any extra steps. If auto-issuance can't complete, a standalone script on the server handles it manually in a couple of commands.
- Generate an API Key and Register Devices Sign in to Headplane with a generated API key, create a user, and issue a pre-auth key. Run tailscale up with your server's login URL on any device, and it joins the mesh.
What Meetrix Brings to This Deployment
- Headplane Included, Not Left as Homework - Most people who self-host Headscale end up running everything from the CLI, because wiring up an admin UI on top is its own project. This AMI ships with Headplane already connected.
- SSL Handled the Way Headscale Actually Needs It - Automatic issuance when your domain is on Route 53, with a tested manual fallback script for when it isn't. You're not reading forum threads to figure out certbot flags.
- A Correct CloudFormation Stack From the Start - VPC, subnet, security groups, and the S3 bucket Headscale uses internally are all provisioned together in one submit. Nothing half-wired.
- No Per-Device Billing - You pay for the EC2 instance underneath, not a monthly fee that climbs every time a laptop, server, or CI runner joins the network.
- Support From People Who Actually Run This - If you need help with DNS, scaling, or access control rules, you're talking to engineers who deploy Headscale regularly, not a ticket queue reading from a script.
Who Is Headscale on AWS Right For?
This deployment fits teams that want Tailscale's day-to-day experience without the control plane, or the bill, sitting outside their own infrastructure. It's a strong match if you're:
- An engineering team that wants a WireGuard mesh without a per-device bill that grows with every laptop and CI runner
- A DevOps team connecting distributed infrastructure - EC2 instances across VPCs, home lab servers, edge devices - into one private network
- A security team that needs the coordination data itself, not just the encrypted traffic, to stay inside your own AWS account
- A startup replacing a hosted mesh VPN subscription as headcount and device count both climb
- An IT consultancy or MSP that wants an isolated mesh network per client engagement instead of one shared tailnet
- A compliance-driven team in finance or healthcare that needs to document exactly where network coordination data lives
- Anyone running infrastructure across multiple clouds or regions who wants one private network tying it together
Headscale on AWS by Meetrix vs Alternatives
| Feature | Headscale on AWS by Meetrix | Tailscale (Hosted) | ZeroTier | Self-Hosted Headscale (Manual) |
|---|---|---|---|---|
| Hosting | Your AWS account - fully self-hosted control plane | Tailscale's cloud, no self-host option for the control plane | ZeroTier's cloud, or a self-hosted Controller on paid plans | Your EC2 instance, configured by you |
| Data Control | Complete - coordination data never leaves your account | Tailscale's infrastructure holds your device and connection map | Depends on plan and whether you self-host the Controller | Complete, if configured correctly |
| Deployment Time | Minutes via AWS Marketplace | Instant signup, no self-host option for the control plane | Instant for hosted, longer to self-host the Controller | Hours - CLI setup, database, reverse proxy, and admin UI by hand |
| SSL & Auth | Automated via Route 53, manual fallback script included | Handled by Tailscale | Handled by ZeroTier on hosted plans | Manual - easy to misconfigure |
| Pricing Model | AWS compute costs only, no per-device fee | Free up to 3 users / 100 devices, then per-user billing | Free tier capped, then per-device billing | AWS compute costs only |
| GDPR / Data Residency | Choose your AWS region, coordination data stays there | Tailscale's data processing terms apply | Vendor's data processing terms apply on hosted plans | Your responsibility to configure |
| Support | Meetrix engineers, commercial SLA | Tailscale support tiers | ZeroTier support tiers | Community forums only |
Resources
How Teams Use This in Production
Stopping a Device Bill That Was Growing Faster Than the Team
The problem
A platform engineering team was running their internal mesh on hosted Tailscale. Every ephemeral CI runner and staging box counted as a billable device, and the monthly cost kept climbing sprint over sprint even though the human headcount barely moved.
What we did
We deployed the Headscale AMI inside their AWS account and moved every device, engineers and CI runners alike, over to it. CI pipelines got their own scoped pre-auth keys so runners register and expire automatically without anyone touching Headplane by hand.
"We kept adding CI runners and watching the Tailscale invoice go up for machines that live for twenty minutes. Moving the control plane onto our own AWS account made that problem go away without changing how anyone actually connects." Platform Lead, DevOps Tooling Company, United States
Keeping the Network's Control Plane Inside a Required EU Region
The problem
A fintech company needed more than encrypted traffic staying in the EU. Their compliance team wanted the coordination data itself, device names, IPs, who's connected to what, to stay in-region too, and a hosted control plane didn't satisfy that requirement on its own.
What we did
We deployed Headscale inside their eu-central-1 VPC, migrated every device over with team-scoped pre-auth keys, and documented the setup for their auditor.
"It wasn't enough to know our traffic was encrypted. We needed to say exactly where the network's control data lived, and self-hosting Headscale in our own region was the only clean answer to that." Head of Infrastructure, Fintech Company, Netherlands
One Headscale Server Per Client Instead of One Shared Tailnet
The problem
An IT consultancy managing infrastructure for multiple clients had been running everyone on a single shared Tailscale tailnet, separated by ACL tags. It worked, but one ACL mistake could theoretically expose one client's devices to another, and billing across shared and dedicated devices was getting hard to untangle.
What we did
We stood up a dedicated Headscale AMI per client engagement, each in its own AWS account with its own users and access rules, replacing tag-based separation with actual network isolation.
"We were one misconfigured ACL tag away from a bad afternoon. Giving each client their own Headscale server instead of a slice of a shared one closed that risk completely." Founder, IT Consultancy, Singapore
Frequently Asked Questions
Is Headscale the same as Tailscale?
No, but it is built to be compatible with it. Headscale is an open-source, self-hosted reimplementation of the Tailscale control server - the piece that keeps track of every device on your network and tells them how to reach each other. Your devices still run the official Tailscale client, but they register with a Headscale server you run yourself instead of Tailscale's hosted service.
Do I need to install anything unusual on my devices?
No. You install the same official Tailscale client apps available for Windows, macOS, Linux, iOS, and Android. The only difference is a login-server flag pointing the client at your own Headscale server instead of Tailscale's default.
Is Headscale free?
Headscale itself is open-source and free. With this AMI, you pay standard AWS compute costs for the EC2 instance running it - there is no per-device or per-user fee added on top.
Does this include an admin dashboard?
Yes. The AMI bundles Headplane, a web-based admin panel for managing users, machines, access control, and DNS. Self-hosting Headscale on your own usually means working entirely from the command line - this AMI gives you a dashboard from the first login.
Can I migrate an existing Tailscale network to this?
There is no one-click import, since your devices are registering with a different control server. Each device needs to run tailscale up again pointed at your new Headscale URL. The upside is the client experience is otherwise identical, so end users barely notice the switch.
Can this scale as my team or device count grows?
Yes. Headscale is lightweight compared to most application workloads, and a single instance comfortably coordinates a large mesh. If you outgrow the default instance size, resize the EC2 instance behind the CloudFormation stack - Meetrix can help plan for larger deployments as part of our support offering.
Run Your Own Tailscale Control Server on AWS
Stop paying per device for a mesh network you don't control. Deploy Headscale on AWS in minutes, set up by a team that runs this stack every day.
Deploy on AWS Marketplace