How to Self-Host Headscale (Private Tailscale Coordination Server) on Contabo VPS

The Beauty of WireGuard Mesh Networks (Tailscale & Headscale)

Traditional point-to-point VPNs require opening public firewall ports and routing all traffic through a single bottleneck server. Tailscale revolutionized networking by creating peer-to-peer encrypted WireGuard meshes where devices communicate directly with one another. Headscale is an open-source, self-hosted implementation of the Tailscale coordination server, giving you full control over machine keys and network topologies with zero commercial device limits.

Deploying Headscale via Docker on Contabo VPS

mkdir -p ~/headscale/config ~/headscale/data
cd ~/headscale
wget -O config/config.yaml https://raw.githubusercontent.com/juanfont/headscale/main/config-example.yaml

Create docker-compose.yml:

services:
  headscale:
    image: headscale/headscale:latest
    container_name: headscale
    restart: always
    ports:
      - "127.0.0.1:8080:8080"
    volumes:
      - ./config:/etc/headscale
      - ./data:/var/lib/headscale
    command: headscale serve

docker compose up -d

Connecting Official Tailscale Clients

On your laptop or mobile device, log into your private network using the official Tailscale client:

tailscale up --login-server https://headscale.yourdomain.com

Your devices can now ping and communicate with each other over a private, end-to-end encrypted 100.64.0.0/10 subnet from anywhere in the world.