Why Headscale Easy?

Headscale works well on its own, and Headscale Easy runs the official, unmodified Headscale binary — it is not a fork or a replacement. What takes time is the glue around it when you want a complete self-hosted setup for several people:

auth + DNS + HTTPS + device management + backups = a weekend project

Headscale Easy packages that glue, in the spirit of wg-easy for WireGuard:

• One container — Headscale, HTTPS and the console in a single image, set up from your browser; pull the new image to update.
• A web console for everyday tasks, modelled on Tailscale's admin panel, where members manage only their own devices.
• Centralised configuration — a few variables or the wizard, one domain.
• Auth, DNS, HTTPS and backups set up with secure defaults.
• Everything self-hosted — use the official Tailscale apps on every device; only the server is yours.

If you are happy running Headscale by hand, you do not need this project. More in Why Headscale Easy?, including the end-to-end workflow.

Headscale Easy and Headplane

Headplane is an established, feature-complete web UI for an existing Headscale — a good choice if you already run Headscale. Headscale Easy installs and wires the whole stack (Headscale, HTTPS, local accounts with 2FA and invitations, backups) and includes its own console. See the detailed comparison.

✨ Features

• 🖥️ Tailscale-style web console at /admin: machines, users, DNS, access controls, keys. Dark and light themes, works on phones.
• 👤 Real user accounts built in: passwords, optional two-factor (TOTP), invitations, password-reset links and sign-up — or plug in your own OIDC provider (Authentik, Keycloak, Pocket ID, Google…).
• 🔒 Every user gets their own private VPN: members only see and reach their own devices (ACL autogroup:self); admins manage everything.
• 📱 Machines: status, addresses, OS and client version with update hints, rename, expire, remove, key expiry, tags, subnet routes and exit nodes, filters, search and CSV export.
• 🐳 Docker tab in Add device: generates the docker run and docker-compose.yml for a Tailscale container (exit node, subnet routes, userspace mode, a pinned Tailscale version), keeps the auth key in a separate .env, gives the command to apply a changed option to a running container, and has a troubleshooting dropdown with eleven common problems.
• ✅ Routes waiting for approval are flagged in the machine's badge, can be approved in one click, and administrators see a banner counting them.
• 🔑 Auth keys (one-off, reusable, ephemeral) and API keys; register devices by auth ID.
• 🌐 DNS: MagicDNS, tailnet domain, nameservers, split DNS, search domains — validated with headscale configtest and rolled back if Headscale refuses them.
• 📝 Access controls: visual editor for rules, groups and tag owners, a test-access simulator ("can ana reach nas:445?"), and the raw HuJSON editor as a full fallback.
• 🔐 HTTPS your way: Let's Encrypt, self-signed, behind your existing proxy (Nginx Proxy Manager, nginx, Traefik, Caddy — ready-made snippets), or plain HTTP on a LAN.
• 🌍 English, Spanish, French, German and Portuguese in the console (more welcome!).
• 💾 Daily backups of everything (database, keys, accounts, configuration) and a one-command restore, also on a new server.
• 🪶 Lightweight: one container, about 70 MB of RAM; the console is plain Python standard library, no build step, no JavaScript framework.