Tag
4 posts
After setting up the control plane, web UI, and relay, the last daily workflow is onboarding devices: use the Tailscale client with tailscale up --login-server to log into self-hosted Headscale, then approve and manage devices in headscale-ui.
Tailscale / Headscale prefers WireGuard P2P, but NAT traversal often fails and traffic falls back to overseas official DERP relays with 100ms+ latency. This post records how I added a domestic self-hosted DERP relay to Headscale, including source modification, self-signed certificates, and anti-abuse setup.
Headscale is CLI-only by default. Adding nodes, approving devices, creating users, and checking routes all require SSH commands. headscale-ui is a static web frontend that calls the Headscale API and moves these operations into the browser. This post records installation, reverse proxy setup, and login pitfalls.
Access your home NAS remotely, connect back to an office network, or build a private mesh across devices. Tailscale makes this feel like 'log in and you are on the same LAN': automatic networking, NAT traversal, and peer-to-peer WireGuard connections. This prologue explains how it works and how it relates to self-hosted Headscale.
