Tag
Headscale is a free, self-hosted implementation of the Tailscale control server: it gives you a private WireGuard mesh network without depending on Tailscale's cloud or its plan limits. This guide brings it up with Docker Compose in its version 0.29.2, prepares the config.yaml file, registers the first node and adds a web panel with headscale-ui.
wg-easy is the simplest way to self-host a WireGuard VPN: a single container that bundles the server and a web panel to create clients in one click. This guide brings it up with Docker Compose in its version 15, completes the first-run setup wizard on port 51821 and connects your first device with a QR code.
WireGuard is simple over a single link, but hand-building a multi-node mesh quickly turns into a tangle of keys and routes. Patterns that work, when pure WireGuard earns its keep, and when it is worth leaning on Tailscale or Headscale instead.
Headscale is an open-source reimplementation of Tailscale's control plane, so official Tailscale clients connect to it unmodified. Version 0.25.1 stabilises HuJSON ACLs, advertised routes, and DNS across large meshes. Running it takes a Go binary, SQLite or PostgreSQL, and a reverse proxy terminating TLS. SSO, Funnel, and analytics remain better commercially.
Nebula is the open source mesh VPN that Slack released on November 19, 2019, after running it internally for over two years. Each node holds its own cryptographic identity and connects directly to the others, so traffic never passes through a central server that decrypts it. The project stays active: version 1.10.3 landed on February 6, 2026.
