What is Headplane?Copy Anchor Link

Headscale is a self-hosted implementation of the Tailscale control server: it lets Tailscale clients form a private network without Tailscale's servers. It doesn't come with a web interface, and Headplane is one, modeled on Tailscale's admin console.

Headplane manages:

• Machines: rename them, change their owner, approve routes and exit nodes, manage tags, and expire or remove them
• Users and auth keys, including what each person can do in Headplane
• Access control: edit the ACL policy visually or as a file
• DNS: the tailnet name, Magic DNS, nameservers, search domains and records

It also adds features Headscale doesn't have:

• Single sign-on through any OpenID Connect provider, or through a reverse proxy, with roles for each person
• Browser SSH into any machine on the tailnet, with no client installed
• The Headplane Agent, which shows each machine's Tailscale version, OS and connectivity

How it connectsCopy Anchor Link

Headplane is a separate server that runs next to Headscale. It reaches Headscale three ways, and each one unlocks part of the UI:

Only the API is required. Access to Headscale's config file is covered under Integrations, and the agent has its own page.

To get started, follow the Quickstart for a new server, or Installation to add Headplane to an existing Headscale.