Run your own Tailscale control plane with Headscale and the Headplane web UI, from a pre-configured AMI in your own AWS account. Devices keep using the official Tailscale apps, with no per-device or per-user fees.
Headscale is a BSD-3 licensed, self-hosted implementation of the Tailscale control server. It hands out keys, tracks the devices in your network and enforces access rules for a WireGuard mesh. Traffic stays end-to-end encrypted by the Tailscale client and never passes through the control server.
Connect laptops, servers and phones in one WireGuard network.
Windows, macOS, Linux, iOS and Android with a login-server flag.
Manage machines, users, access control and DNS in the browser.
Name-based access, subnet routing and exit nodes.
Sign in through Keycloak, Entra ID, Google and other OIDC providers.
No per-user or per-device limits or billing.
Self-hosting Headscale usually means CLI setup, a database, a reverse proxy and no dashboard. The AMI adds Headplane so you have a UI from the first login.
Subscribe on AWS Marketplace and launch the CloudFormation stack with your domain and admin email. Allow 5-10 minutes.
Create a DNS record with the PublicIp from the stack outputs.
Run sudo headscale apikeys create on the server and paste the key at your ServerUrl/admin/login.
Create a user and a pre-auth key, then run tailscale up with --login-server and --authkey on each device.
An AMI on AWS Marketplace, launched into your own AWS account with a CloudFormation stack.
Launch on AWS | Headscale by Meetrix | Tailscale (hosted) | ZeroTier | |
|---|---|---|---|
| Control plane | In your AWS account | Tailscale's cloud | ZeroTier's cloud, or self-hosted on paid plans |
| Coordination data | Never leaves your account | Held by Tailscale | Depends on plan |
| Pricing model | AWS compute only, no per-device fee | Free up to 3 users and 100 devices, then per user | Capped free tier, then per device |
| Maintenance | Yours, with Meetrix support | None, fully managed | None on hosted plans |
Managed Tailscale still wins if nobody wants to run a server. Read Headscale vs Tailscale →
No, but it is compatible. Headscale is a self-hosted reimplementation of the Tailscale control server; your devices still run the official Tailscale client and register with your server instead.
No. Install the official Tailscale app and point it at your Headscale server with the --login-server flag.
Headplane uses an API key rather than a password. Run sudo headscale apikeys create on the server and paste the key at your ServerUrl/admin/login.
Create a user with headscale users create, generate a key with headscale preauthkeys create, then run tailscale up --login-server=<your-domain> --authkey=<key> on the device.
The encryption is the same, because the Tailscale client enforces WireGuard end to end. Patching, TLS and backups for the control server become your responsibility.
There is no one-click import. Each device runs tailscale up again against your Headscale URL; after that the experience is the same.
t3a.small is enough to start, since the coordination server is lightweight.
Headscale is open source and free. You pay for the EC2 instance, plus any Meetrix software fee shown on the marketplace listing, with nothing per device or user.
Your own control server, Headplane, peer relays, SSO, and when managed Tailscale wins.
Your own Tailscale control plane, without the per-device bill.
Launch the stack, sign in to Headplane and register devices.
We build and run self-hosted network infrastructure every day, from mesh VPNs to SSO. Tell us what you need.
Contact us