> Source: https://meetrix.io/store/headscale/ > Markdown copy of that page. Cite the URL above, not this file. [Store](https://meetrix.io/store/) Headscale Self-hosted Tailscale alternative # Self-hosted Headscale control server on AWS Run your own Tailscale control plane with Headscale and the Headplane web UI, from a pre-configured AMI in your own AWS account. Devices keep using the official Tailscale apps, with no per-device or per-user fees. [Launch on AWS](https://aws.amazon.com/marketplace/pp/prodview-6gvmv4nn335ei) - Headplane admin UI included - Official Tailscale clients - No per-device fees ![Headscale control server deployed on AWS by Meetrix](https://meetrix.io/assets/store/headscale/headscale.webp) ## What is Headscale? Headscale is a BSD-3 licensed, self-hosted implementation of the Tailscale control server. It hands out keys, tracks the devices in your network and enforces access rules for a WireGuard mesh. Traffic stays end-to-end encrypted by the Tailscale client and never passes through the control server. - ### Private mesh VPN Connect laptops, servers and phones in one WireGuard network. - ### Official clients Windows, macOS, Linux, iOS and Android with a login-server flag. - ### Headplane web UI Manage machines, users, access control and DNS in the browser. - ### MagicDNS and exit nodes Name-based access, subnet routing and exit nodes. - ### SSO with OIDC Sign in through Keycloak, Entra ID, Google and other OIDC providers. - ### No device caps No per-user or per-device limits or billing. ## What's in the Meetrix Headscale AMI Self-hosting Headscale usually means CLI setup, a database, a reverse proxy and no dashboard. The AMI adds Headplane so you have a UI from the first login. - Headscale running as a systemd service - Headplane admin panel running in Docker at /admin - Automatic SSL when your domain is hosted on Route 53 - A certificate script for issuing SSL manually otherwise - A CloudFormation template for your own AWS account - Email support from Meetrix at aws@meetrix.io ## How to set up a self-hosted Headscale server 1. ### Launch the stack Subscribe on AWS Marketplace and launch the CloudFormation stack with your domain and admin email. Allow 5-10 minutes. 2. ### Point your domain at it Create a DNS record with the PublicIp from the stack outputs. 3. ### Sign in to Headplane Run sudo headscale apikeys create on the server and paste the key at your ServerUrl/admin/login. 4. ### Register devices Create a user and a pre-auth key, then run tailscale up with --login-server and --authkey on each device. ## Deploy on AWS ### Headscale on AWS An AMI on AWS Marketplace, launched into your own AWS account with a CloudFormation stack. Deploys with CloudFormation Recommended size t3a.small Ready in 5-10 minutes #### Setup guides - [**Developer guide** Launch, Headplane, devices, SSL](https://meetrix.io/blogs/headscale-developer-guide/) - [**Headscale on AWS Marketplace** Who it suits and how it compares](https://meetrix.io/blogs/headscale-aws-marketplace/) [Launch on AWS](https://aws.amazon.com/marketplace/pp/prodview-6gvmv4nn335ei) ## Headscale by Meetrix vs Tailscale vs ZeroTier | | Headscale by Meetrix | Tailscale (hosted) | ZeroTier | | --- | --- | --- | --- | | Control plane | In your AWS account | Tailscale's cloud | ZeroTier's cloud, or self-hosted on paid plans | | Coordination data | Never leaves your account | Held by Tailscale | Depends on plan | | Pricing model | AWS compute only, no per-device fee | Free up to 3 users and 100 devices, then per user | Capped free tier, then per device | | Maintenance | Yours, with Meetrix support | None, fully managed | None on hosted plans | Managed Tailscale still wins if nobody wants to run a server. [Read Headscale vs Tailscale →](https://meetrix.io/blogs/headscale-vs-tailscale/) ## Headscale FAQ Is Headscale the same as Tailscale? No, but it is compatible. Headscale is a self-hosted reimplementation of the Tailscale control server; your devices still run the official Tailscale client and register with your server instead. Do I need special apps on my devices? No. Install the official Tailscale app and point it at your Headscale server with the --login-server flag. How do I sign in to Headplane? Headplane uses an API key rather than a password. Run sudo headscale apikeys create on the server and paste the key at your ServerUrl/admin/login. How do I add a device? Create a user with headscale users create, generate a key with headscale preauthkeys create, then run tailscale up --login-server= --authkey= on the device. Is Headscale as secure as Tailscale? The encryption is the same, because the Tailscale client enforces WireGuard end to end. Patching, TLS and backups for the control server become your responsibility. Can I move an existing Tailscale network? There is no one-click import. Each device runs tailscale up again against your Headscale URL; after that the experience is the same. Which instance size should I choose? t3a.small is enough to start, since the coordination server is lightweight. Is Headscale free? Headscale is open source and free. You pay for the EC2 instance, plus any Meetrix software fee shown on the marketplace listing, with nothing per device or user. ## Headscale guides and articles ### [Headscale vs Tailscale: Self-Hosted Tailscale Control Server](https://meetrix.io/blogs/headscale-vs-tailscale/) Your own control server, Headplane, peer relays, SSO, and when managed Tailscale wins. ### [Headscale on AWS Marketplace](https://meetrix.io/blogs/headscale-aws-marketplace/) Your own Tailscale control plane, without the per-device bill. ### [Headscale: Developer Guide](https://meetrix.io/blogs/headscale-developer-guide/) Launch the stack, sign in to Headplane and register devices. ## Need a hand with Headscale? We build and run self-hosted network infrastructure every day, from mesh VPNs to SSO. Tell us what you need. [Contact us](https://meetrix.io/contact-us/)