Series
Tailscale Lab
Hands-on notes for a private network built around Tailscale, Headscale, self-hosted DERP, and everyday device onboarding.
4 posts · Read in order
- 1
What Is Tailscale: A Practical Introduction to P2P Private Networking
Access your home NAS remotely, connect back to an office network, or build a private mesh across devices. Tailscale makes this feel like 'log in and you are on the same LAN': automatic networking, NAT traversal, and peer-to-peer WireGuard connections. This prologue explains how it works and how it relates to self-hosted Headscale.
June 16, 2026 · 4 min read
- 2
Adding a Web UI to Headscale: headscale-ui Setup Notes
Headscale is CLI-only by default. Adding nodes, approving devices, creating users, and checking routes all require SSH commands. headscale-ui is a static web frontend that calls the Headscale API and moves these operations into the browser. This post records installation, reverse proxy setup, and login pitfalls.
June 16, 2026 · 4 min read
- 3
Self-Hosted DERP Relay: Stable 20ms Domestic Fallback for Headscale
Tailscale / Headscale prefers WireGuard P2P, but NAT traversal often fails and traffic falls back to overseas official DERP relays with 100ms+ latency. This post records how I added a domestic self-hosted DERP relay to Headscale, including source modification, self-signed certificates, and anti-abuse setup.
June 16, 2026 · 5 min read
- 4
Joining Devices to Self-Hosted Headscale: From tailscale up to headscale-ui Management
After setting up the control plane, web UI, and relay, the last daily workflow is onboarding devices: use the Tailscale client with tailscale up --login-server to log into self-hosted Headscale, then approve and manage devices in headscale-ui.
June 16, 2026 · 4 min read