LoginSign Up
← Back to all sparks
H

Headscale

INFRA · APIS
Velocity0.0

Self-hosted implementation of the Tailscale control server

headscale.net ↗

Headscale stops approximating Tailscale's control plane and starts matching it on purpose.

self-hostedtailscaleaccess-controlaclssh
◆Current state
Headscale's visible work is a single long beta line, 0.29.0-beta.1 through beta.4, spread from late May to mid-June. The release notes are cumulative and identical across all four betas, describing a rebuilt ACL packet-filter implementation validated against real Tailscale clients and the official SaaS, plus support for SSH rules using the check action with OIDC or CLI approval. Minimum supported Tailscale client is pinned at v1.80.0.
◆Where it's heading
The project is treating behavioural parity with the hosted service as something to be tested rather than assumed — generating ACL test cases systematically against the SaaS and fixing the differences that surfaced. Adding interactive SSH approval moves headscale past connectivity into access control, which is the harder half of what Tailscale sells. The long beta series without a stable cut suggests the maintainers are unwilling to ship that surface until the packet-filter differences are fully closed.
◆Prediction
A stable 0.29.0 is the obvious next step once the beta line settles, since the feature set has been frozen across four betas. What remains unclear from these notes is what actually changed between the betas, as each restates the same cumulative text.

◆Recent moves

  1. 2mo ago

    Register user-lookup error reworded to match the CLI test

    A tag on a backup branch carrying a single commit that rewords an error string to match what the CLI auth test expects. Internal housekeeping that surfaces in the feed as if it were a release.

    View source ↗
  2. 2mo ago

    v0.29.0-beta.4

    The fourth beta on the 0.29.0 line, published four days after beta.3. Its notes restate the series' cumulative feature set verbatim, so the specific fixes in this increment are not visible from the release body.

    View source ↗
  3. 2mo ago

    v0.29.0-beta.3

    The third beta, arriving roughly two weeks after beta.2 and carrying the same cumulative notes. The tight beta spacing is the signal here — the line is being iterated on actively rather than parked.

    View source ↗
  4. 2mo ago

    v0.29.0-beta.2

    The second beta on the 0.29.0 line, one week after the first. As with the rest of the series, the release body repeats the cumulative feature description rather than listing what this increment changed.

    View source ↗
  5. 2mo ago

    0.29.0 beta: SSH check actions and Tailscale ACL parity

    ⚡ SPARK

    The 0.29.0 line is where headscale stops approximating Tailscale's control plane and starts matching it deliberately: ACL packet-filter generation was rebuilt against systematically generated test cases, and SSH rules gained check-action support with OIDC or CLI approval. This is the substantive release of the current window, with the three later betas restating its notes.

    View source ↗