[email protected]
DEEN

Headscale Managed Hosting, Installation and Operations

WZ-IT installs and operates Headscale as a self-hosted control server. We integrate OIDC, ACLs, DNS, subnet routers and DERP into your network and identity architecture and handle monitoring, backups and updates.

  • Self-hosted control server
  • Official Tailscale clients
  • control over data location and access
Request hostingHosting & pricing
Reviews
At a glance
  • OperationManaged Hosting
  • Monitoring24/7
  • Service Levelselectable as needed
Cloud Wolke HerausforderungServer NachhaltigkeitIT Beratung Service Consulting SoforthilfeTimo Wevelsiep Robin ZinsExperten für Innovation Migration AWSHetzner Hosting zuverlässig

Companies worldwide trust WZ-IT

  • Stadtwerke Brühl
  • DGHO e.V.
  • ABCO Water Systems
  • Golem.de
  • EVADXB
  • nextGYM
  • AInergy
  • ml&s
  • Odiseo Solutions
  • Annota
  • ARGE
  • SweetConnect GmbH
  • Aphy AG
  • CORGOS
  • Rekorder
  • SolidProof
  • Yonju
  • Keymate
  • Paritel
  • Mr. Clipart
  • Millenium
  • Negosh
  • Führerscheinmacher
  • Boese VA
Read client reviews

About the technology

What is Headscale?

Headscale is a self-hosted, open-source implementation of the Tailscale control server. With complete control over your VPN network, Headscale provides a secure alternative for organizations of any size.

As a self-hosted solution, Headscale implements the same features as Tailscale but without external dependencies. The solution supports modern VPN technologies, Access Control Lists (ACLs), and Single Sign-On (SSO) integration.

GitHubWebsite

Headscale Features

  • Fully Self-Hosted

    Run your own Tailscale control server with complete control over your network infrastructure.

  • Access Control Lists (ACLs)

    Granular network access controls with tag-based authorization and group management.

  • Single Sign-On (SSO)

    OIDC integration with Keycloak, Active Directory, Google, Azure AD, and other identity providers.

  • Exit Nodes

    Route all internet traffic through designated exit nodes for secure external connections.

  • MagicDNS & Custom DNS

    Automatic DNS resolution for VPN hosts and custom DNS records for internal services.

  • API Management

    Complete REST API for node management, ACL administration, and network configuration.

Infrastructure, integration and operations

Headscale as part of your infrastructure

We do more than provide an application. WZ-IT designs the technical architecture, integrates network and identity, operates the agreed scope and develops integrations when the standard product is not enough.

Architecture and migration

Sizing, target environment, data transfer, cutover and recovery are resolved before production operations.

  • On-Premise

    In your data center: Installation on bare-metal, VM or Docker · Integration with existing Active Directory/LDAP

  • Cloud Installation

    AWS, Azure, Hetzner & more: Terraform/IaC setup (optional) · Kubernetes or Docker Compose · Capacity and scaling design

  • Enterprise Setup

    Advanced architecture after technical and licence assessment: HA and recovery design where supported by the application and edition · Logging according to feature set and edition · Custom security policies

Network and identity

SSO, secure access, internal systems and existing security components are integrated appropriately.

  • VPN Access

    WireGuard, NetBird, Tailscale, Headscale, OpenVPN, Cloudflare Tunnel

  • SSO Integration

    Directly or through an upstream identity layer

  • Multi-Factor Auth

    Depends on application, edition and identity provider

  • Firewall & Hardening

    Fail2Ban, Rate Limiting, IP Whitelisting

Monitoring and service level

Updates, backups, technical monitoring and response paths follow a transparent operational scope.

  • 24/7 proactive monitoring

  • Updates and patches

    CVE and security-advisory monitoring for the operating system and managed application, regular updates, and priority deployment of available patches for critical vulnerabilities

  • Daily backup with 7-day retention

  • Personal technical contact

Full-service installation with no hidden costs

What the Headscale setup includes

  • Complete installation & configuration
  • SSL certificate & reverse proxy setup
  • Backup strategy & disaster recovery
  • Performance optimization & tuning
  • Security hardening following OWASP
  • Monitoring & logging setup
  • Documentation & best practices
  • Administrator training (remote)
  • 30 days email support included
  • Dedicated contact person
  • Optional integration: LDAP/AD, SSO, MFA
  • Update strategy & patch management setup

The exact scope depends on the application, edition, infrastructure and criticality. Vendor licences and non-standard components are quoted separately.

Headscale vs. Tailscale

Headscale vs. Tailscale SaaS: what works, what is missing

Headscale is the open-source implementation of the Tailscale control server (BSD-3-Clause, around 41,000 GitHub stars). The official Tailscale clients connect to your server via "tailscale up --login-server"; the project aims to support the last 10 client releases. What you can expect from it - and what not:

Supported

  • MagicDNS & split DNS
  • Taildrop (file transfer between devices)
  • Subnet routers & exit nodes
  • ACLs, tags & auto approvers
  • Tailscale SSH & OIDC registration
  • Embedded DERP relay & ephemeral nodes

Not or only partially supported

  • Funnel - exposing services publicly to the internet
  • Serve - only partially available
  • Network flow logs for audit purposes
  • OIDC groups cannot be used in ACLs
  • Only a single tailnet - no multi-tenant operation
For an honest assessment: the project's README describes its own scope as deliberately narrow - a single Tailscale network (tailnet), suitable for personal use or a small organisation. You should know these limits before planning Headscale company-wide.

Hosting & operations

How much does hosting for Headscale cost?

We combine the right compute size with ongoing operations, backups, monitoring and a service level appropriate for the criticality of Headscale. High availability and recovery targets are designed separately where needed.

Hosting & operations from€129.90/ month · Modular pricing based on your requirements - service level, apps and compute selectable individually.

Hosting for Headscale in Germany: GDPR-compliant operations

  • One managed standard application included
  • Dedicated compute workload in S, M, L or XL
  • Subdomain on wz-it.cloud included
  • German provider, German data centres, no US clouds
  • ISO 27001-certified and BSI C5-attested data centres
  • 99.9 % standard availability per month
  • CVE and security-advisory monitoring for the operating system and managed application, regular updates, and priority deployment of available patches for critical vulnerabilities
  • Central collection of agreed system and operations logs with immutable retention
  • Daily backup with 7-day retention
  • 5 TB outbound traffic per workload and month
  • 24/7 proactive monitoring
  • Five clearly separated service levels
  • 24/7 P1 response with Production or Critical
  • Personal technical contact
Configure now

All prices are net and exclude statutory VAT. The offers are addressed to businesses. All on-premises options

Other options

Try it free for 7 days

Request a test instance

We set up a test instance for you, usually on the next business day. No payment details required. After seven days it is deleted unless you continue.

Request a test instance →Bring Your Own Infrastructure

Installation on Your Infrastructure

Installation on your own infrastructure · On-premise or in your cloud · Control over data location and access · Custom configuration · Complete documentation · Initial setup & configuration · Optional support and maintenance contract

Price on request, plus optional support & maintenanceRequest a proposal →On-premises option

Run Headscale on hardware at your organisation

As an alternative to managed hosting in the data centre, WZ-IT provides the hardware, configures Headscale, and handles hardening, monitoring, updates, backup and technical support. Access can be limited to the internal network or enabled through VPN and existing identities.

from €349 excl. VAT / month · plus one-time provisioning and initial setupView WZ-IT App Node →

Decision guidance

An honest assessment: when Headscale, when NetBird

A trust fact on the side: Headscale is "not associated with Tailscale Inc.", but Tailscale employs the head maintainer (without directing the project) and actively helps maintain compatibility of the official clients. Headscale fits when:

Headscale

Headscale fits when

  • You want to use the mature official Tailscale apps on all platforms
  • Control and coordination data must remain entirely on your own infrastructure
  • A single tailnet is sufficient for your team or organisation
  • You prefer a lean, focused setup over a large feature set

NetBird

Need a larger self-hosted scope? NetBird

    Scope boundary and notes

    NetBird is a standalone product with its own dashboard, user and group management and access policies - designed from the start as a fully-fledged self-hosted platform. If your setup grows beyond a single tailnet or you need a central management interface, NetBird is usually the better fit. We will advise you honestly on which approach suits your environment.

    View NetBird →

    Role in the overall system

    Related services for Headscale

    This page covers installation and the agreed platform operations for Headscale. Custom code, the access layer and special confidentiality requirements remain clearly separated responsibilities that can be added when needed.

    Maintain the application

    Support custom code and integrations

    Keep custom extensions, interfaces and dependencies controlled, updated and supportable.

    from €699.90 excl. VAT / monthView service     Secure access

    Connect users, sites and systems

    Add identity-based access and private network paths as a separate operational layer.

    from €349.90 excl. VAT / monthView service     Operate confidentially

    Assess Section 203 requirements separately

    For professional secrecy holders, define contractual, access and infrastructure requirements in a dedicated operating model.

    from €499.90 excl. VAT / monthView service

    Three relevant adjacent paths instead of a long list of further products. All prices are net and exclude statutory VAT. The offers are addressed to businesses.

    View the overall system

    Frequently Asked Questions

    Answers to the most important questions

    Knowledge

    Further remote access guides

    In-depth knowledge from our remote access knowledge base.

    Guides from the knowledge base

    Tutorials & guides

    Matching solutions for your project

    Reviews & projects

    Client feedback and projects worldwide

    WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
    Steve KirchnerManaging Director, nextGYM GmbH
    View project

    International

    Built in Germany's Ruhr Valley. Running worldwide.

    WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.

    Selected projects

    Read client reviews

    • Secure your Proxmox & backup setup
    • Modernize your infrastructure - sovereign
    • Plan a sovereign open-source stack
    • Integrate a local AI solution
    • Modernize your legacy software
    • Cut cloud cost - up to −81%
    • Build a high-availability Proxmox cluster
    • Virtualize with Managed Proxmox
    • Design an open-source AI architecture
    • Get collaboration fully managed
    • Ship your prototype to production
    • Connect sites and clusters securely

    Hosting & operations

    Enquire about hosting and operations for Headscale

    Briefly describe the current state and objective for Headscale. We assess infrastructure, integration, and ongoing operations.

    • Straight with Timo and Robin - no sales team, no pitch
    • An honest take, including when we are not the right fit
    • Concrete next steps for infrastructure, software or AI

    No risk: worst case, you leave with a clearer understanding of your project than before.

    Email[email protected]Phone+49 2922 875068
    Timo and Robin, founders of WZ-IT

    Which Headscale service do you need?

    Choose the appropriate starting point or simply describe the situation.

    We usually respond within one business day. Please do not submit credentials.

    WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
    Jakob ÖschlbergerInno7 GmbH