Self-hosted Tailscale: Headscale, its trade-offs, and the sovereign-relay approach

Why self-host your mesh VPN at all

A managed mesh VPN is convenient, but it creates a dependency: a third-party service knows your machines, decides who talks to whom, and — depending on the architecture — may see your relayed traffic pass through. Three motivations come up again and again among people searching for “self-hosted Tailscale”.

The Headscale path

Tailscale does not offer an official self-hosted control plane. Headscale is a third-party open source project, unaffiliated with Tailscale, that reimplements the coordination server: it fills that need in the community, and does it well — it is a fine project, widely used by those who want a community-run control plane for their Tailscale clients.

Like any self-hosted solution, this path comes with factual trade-offs you should know before committing.

• You are the operator. The coordination server becomes a service you install, host, back up, update, and monitor — and it sits at the heart of your network: if it goes down, bringing it back is on you.
• Unofficial, unsupported by the vendor. Headscale is not a Tailscale product: the project’s community, not the vendor, maintains it.

The question nobody asks: what does the server you host actually see?

“Self-hosted” does not say what you are hosting. A mesh VPN has two distinct planes, and they do not see the same things.

• The control plane (coordination server, console) knows your machines, your identities, your access rules. It decides who may talk to whom — but it does not carry your bytes.
• The data plane (direct connections and relays) carries your bytes. When two machines cannot reach each other directly, traffic goes through a relay — and that is where your data actually travels.

Self-hosting the control plane brings your network’s metadata in-house — that is valuable. But if your primary requirement is “my data must only transit through my servers”, then it is the data path — the relay — that you need to bring home. The two questions deserve to be asked separately.

The VIGIL-MESH approach: the sovereign relay

VIGIL-MESH makes the opposite choice to Headscale, and we say it plainly: the control plane (the admin console) remains a hosted SaaS service — it is not self-hostable today. The data path, however, can be entirely yours: relayed traffic can go through your own relay, the private vigie.

• Structurally blind. The vigie holds no session keys and only ever sees packets that are already end-to-end encrypted — even if compromised, it cannot read your traffic.
• Self-configuring. It registers automatically with the controller using a single-use token and receives its entire configuration: no control plane for you to operate.
• Dedicated to your workspace. Its scope is locked on the controller side: it refuses to serve any other customer and never appears in the public directory.
• Sovereignty of the path. Your relayed bytes only transit through your servers, never through shared infrastructure you do not control.

Here is the honest comparison of the two approaches — including where Headscale keeps the advantage.

Frequently asked questions