Headscale
github.com · Egress and tunnels · 1 record · JSON
Headscale Egress and tunnels
paidanonymousno cardDvolume-quota
| Free tier | BSD-3 control server for Tailscale clients, with no node cap unit unlimited; metered on identity-count |
|---|---|
| Price | none stated |
| Per-object cap | not applicable |
| Retention | not applicable |
| Egress | signalling only once peers connect directly; DERP relay only when they do not |
| Identity | anonymous the software needs no account |
| Binding | volume-quota the software imposes no byte meter; what runs out is the monthly egress allowance of the host it runs on, and that host is a separate provider |
| Interface | cli tailscale up --login-server against your own headscale |
| Tooling | tailscale clients against headscale |
| Composes with | signalling for a private mesh: it composes with the client's own machines and carries no bytes once they hole-punch. |
| Reliability | the control server's uptime is the constraint |
| Notes | 2026-10-23: public instances exist and carry no ingress. One public control server, headscale.kf8edq.dev, publishes join keys and shows 'Active Nodes 4 / 5 total', so the free public instance is a 5-node control plane with no public listener of any kind. A control plane distributes keys and endpoints; the payload never touches it, which is why headscale cannot satisfy ingress test at any size. Re-graded 2026-10-23: the software is free and the path is not, because it needs a host. The finding is the host. |
| Evidence rung | documented no probe: a control server was not stood up. The claim rests on the project page, and the read path a client would take is the Tailscale one measured in tailscale-personal |
| Checked | 2026-10-23 (live); stale on 2026-11-22 |
Evidence (2)
| date | source | what it proved |
|---|---|---|
| 2026-10-22 | github.com/juanfont/headscale | BSD-3 control server with no node limit stated |
| 2026-10-23 | kf8edq.dev/ | a public headscale instance advertising 'Active Nodes 4 / 5 total' and an authkey join flow, with no service-publishing feature, read through the search index |
More fields (4)
{
"stale_after_days": 180,
"bytes_transit": "no",
"transit_note": "a control server for Tailscale clients: it distributes keys and endpoints and sees no payload",
"hosting_requirement": "a rented or free compute service"
}