Tailscale

Introduction

Tailscale is a VPN service that uses WireGuard to create a fast, secure, and simple peer-to-peer network. Tailscale is a zero config VPN that works on any platform, service, or runtime. It encrypts all connections using WireGuard and integrates with 100+ tools for easy deployment and management.

Tailscale is a modern VPN built on top of Wireguard. It works like an overlay network between the computers of your networks - using NAT traversal.

Everything in Tailscale is Open Source, except the GUI clients for proprietary OS (Windows and macOS/iOS), and the control server.

The control server works as an exchange point of Wireguard public keys for the nodes in the Tailscale network. It assigns the IP addresses of the clients, creates the boundaries between each user, enables sharing machines between users, and exposes the advertised routes of your nodes.

A Tailscale network (tailnet) is private network which Tailscale assigns to a user in terms of private users or an organisation.

Self Hosting

You can self host a Tailscale server with Headscale + Headscale UI.

Headscale is an open source, self-hosted implementation of the Tailscale control server. Headscale's goal is to provide self-hosters and hobbyists with an open-source server they can use for their projects and labs. It implements a narrow scope, a single Tailnet, suitable for a personal use, or a small open-source organisation.

Headscale UI is a web frontend for the headscale Tailscale-compatible coordination server.

YouTube - Jim's Garage - Self Host Tailscale with Headscale

Configure and run Headscale

Docker

You can self host a Tailscale server with Headscale + Headscale UI docker containers.

This is the directory layout for a Docker Compose method ...

/root/docker/stacks/headscale
|-- config
|   `-- config.yaml
|-- data
|   |-- db.sqlite
|   `-- noise_private.key
|-- docker-compose.yaml
`-- run
    `-- headscale.sock

3 directories, 5 files

... and this is the docker compose YAML file which has both Headscale and Headscale UI containers ...

services:

  headscale:
    container_name: headscale
    volumes:
        - ./config:/etc/headscale/
        - ./data:/var/lib/headscale/
        - ./run:/var/run/headscale/
    ports:
        - 8080:8080
        - 9090:9090
    image: headscale/headscale:0.23.0-alpha12
    environment:
      - TZ=Europe/London
    command: serve
    restart: unless-stopped
    networks:
      traefik:
        ipv4_address: 172.19.0.28
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      - "traefik.http.routers.headscale.rule=PathPrefix(`/`) && Host(`headscale.domain.com`)"
      - "traefik.http.routers.headscale.entrypoints=websecure"
      - "traefik.http.routers.headscale.service=headscale"
      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
      - "traefik.http.services.headscale.loadbalancer.server.scheme=http"

  headscale-ui:
    image: ghcr.io/gurucomputing/headscale-ui:latest
    pull_policy: always
    container_name: headscale-ui
    restart: unless-stopped
    ports:
        - 9999:80
    networks:
      traefik:
        ipv4_address: 172.19.0.29
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik"
      - "traefik.http.routers.headscale-ui.rule=PathPrefix(`/web`) && Host(`headscale.domain.com`)"
      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
      - "traefik.http.routers.headscale-ui.service=headscale-ui"
      - "traefik.http.routers.headscale-ui.middlewares=auth"
      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
      - "traefik.http.services.headscale-ui.loadbalancer.server.scheme=http"
      - "traefik.http.middlewares.auth.basicauth.users=funkyusername:xxxxxxxxxxxxxxxxhashedxxxxpasswordxxxxxxxxxxxxxxx"

networks:
  traefik:
    external: true

Start up the containers, and you should see this in the docker logs ...

Authentication

https://github.com/gmiles32/headscale-authelia

Remote Access

Remote Access using Tailscale

RustDesk > settings > Network > Direct IP Access + IP Address Whitelisting