# Headscale / NetBird

A mesh VPN you host. Headscale is BSD-3; NetBird is AGPL-3.0 — Tailscale without the coordination seat.

**Replaces:** Tailscale

**Tier:** Medium

## Problem

Tailscale is WireGuard plus a coordination server you do not run. Headscale is the BSD-3 open-source control server that speaks the Tailscale client protocol. NetBird is AGPL-3.0 if you want that mesh instead. Clients stay on the devices. This is not every Tailscale ACL, exit-node, or app-connector product.

## Stack

- [Headscale](https://headscale.net) — BSD-3 Tailscale-compatible control server
- [NetBird](https://netbird.io) — AGPL-3.0 WireGuard mesh if you want that stack

## Estimated SaaS cost saved

| You stop paying | Typical / year | Self-host instead |
|---|---:|---|
| Tailscale paid coordination (small team) | $1,200 | Headscale or NetBird |

**About $1,200 / year** on a small team, before you count lock-in.

## Deploy on Railway

Placeholder: Headscale (or NetBird management) plus a volume for the node database. Clients stay on laptops and servers. No one-click template in this repo yet — Start on Railway. Public tunnels stay on /stacks/frp-tunnel.

[Start on Railway](https://c17.io/go/railway/headscale-vpn?from=%2Fstacks%2Fheadscale-vpn.md)

[frp if this is a public URL, not a mesh VPN](https://c17.io/stacks/frp-tunnel)

## AGENT_PROMPT

```
Replace Tailscale coordination with Headscale (preferred) or NetBird.

- Headscale: persist the database, bind the API, issue a preauth key, join one official Tailscale client.
- NetBird if you want their management UI instead of the Tailscale client protocol.
- Write AGENT_PROMPT.md. Do not claim every Tailscale ACL or exit-node feature.
```

## FAQ

### Do I keep the Tailscale app?

With Headscale, yes — you point the official client at your server. NetBird uses its own clients.

### Why not frp?

frp is a public tunnel (/replace/ngrok). Tailscale is private mesh networking. Different job.

Source: https://c17.io/stacks/headscale-vpn