A self-hosted, open source implementation of the Tailscale control server for running your own WireGuard-based mesh network.
tale/headplane
A web UI for managing self-hosted Headscale servers, covering nodes, ACLs, DNS and Headscale settings.
Open-source alternative to:Tailscale
- Stars
- 3,200
- Forks
- 255
- Open issues
- 40
- Last commit
- 2 days ago
What is it?
Headscale is a self-hosted, open-source implementation of the Tailscale control server, but it ships without a graphical interface. Headplane fills that gap as a web dashboard for Headscale, letting administrators manage machines, networks and access policies from a browser instead of the command line.
The project aims to match the functionality of the official Tailscale dashboard. It covers machine management such as expiry, network routing, naming and ownership, along with Access Control List (ACL) editing and tag-based ACL enforcement. It also supports OpenID Connect (OIDC) for login, lets you edit DNS settings and provision Headscale, and exposes Headscale's configuration options.
Headplane is written in TypeScript and is designed to be deployed alongside an existing Headscale instance. Pre-release builds are published under a next tag, and releases follow semantic versioning from v0.6.0 onward.
Key features
- 01Manage machine expiry, routes, names and owners
- 02Edit ACLs and apply tag-based access control
- 03Log in via OpenID Connect (OIDC)
- 04Edit DNS settings and provision Headscale
- 05Adjust Headscale configuration from the UI
Use cases
- Running a self-hosted Tailscale-style VPN without using the command line for daily administration
- Managing device access and ACL policies for a small team or homelab network
- Providing SSO-based login to a Headscale admin dashboard via an existing OIDC provider
Quick start
- 1
Read the installation instructions on the project website
- 2
Follow the deployment guide at headplane.net to install and run Headplane
Things to know
- Requires an existing Headscale server, as it is only a web UI for Headscale.
- Deployment details are only in the external website, not in the README.
In collections
Topics
FAQ
- What is headplane?
- A web UI for managing self-hosted Headscale servers, covering nodes, ACLs, DNS and Headscale settings. Headscale is a self-hosted, open-source implementation of the Tailscale control server, but it ships without a graphical interface. Headplane fills that gap as a web dashboard for Headscale, letting administrators manage machines, networks and access policies from a browser instead of the command line.
- Is headplane free to use? What license does it have?
- headplane is open source under the MIT license. Check the license terms before using it in commercial products.
- Is headplane still maintained?
- Actively maintained. The last commit to headplane was on Oct 22, 2026.
- What can I use headplane for?
- Running a self-hosted Tailscale-style VPN without using the command line for daily administration Managing device access and ACL policies for a small team or homelab network Providing SSO-based login to a Headscale admin dashboard via an existing OIDC provider
- How do I install headplane?
- Read the installation instructions on the project website Follow the deployment guide at headplane.net to install and run Headplane
- Where can I get headplane?
- The source code and installation instructions are on GitHub: https://github.com/tale/headplane
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
Docker-based web admin UI for installing and managing a WireGuard VPN server and its client configurations.
A decentralized mesh VPN written in Rust that connects devices into a virtual LAN with NAT traversal and WireGuard support.
Self-hosted secure remote access platform combining WireGuard VPN, identity management, MFA and network access control.
Tailscale builds private WireGuard-based networks between your devices; this repo holds its tailscaled daemon and tailscale CLI.
Open-source WireGuard-based mesh VPN that connects machines, people and AI agents over peer-to-peer encrypted tunnels with identity-based access control.