Headscale vs Tailscale for a Household: The Control-Plane Trade-off Nobody Mentions

Headscale is sold, in homelab rooms, as Tailscale without the company. That sentence is half true and it is the half that gets households in trouble. You still run official Tailscale clients. You still punch holes and fall back to relays. What you take home is the control plane: the service that issues keys, pushes ACLs, answers “who is on this tailnet,” and tells a new phone how to find the NAS.

For a household, that control plane is not a philosophy. It is the difference between a partner reinstalling the app after a phone swap and you getting a Slack message from yourself at 11 p.m. because a preauth key expired and nobody else can mint another one.

I have run both. I still pay for Tailscale on one family tailnet. I run Headscale on another. This piece assumes you already want a Tailscale-shaped mesh; if you are still weighing that against a commercial VPN, start with the real trade-offs of Tailscale versus a traditional VPN. The split has nothing to do with which logo I prefer. It has to do with who is allowed to be unavailable when a device needs to join.

What you are actually self-hosting

Tailscale the product is a client, a coordination server, optional DERP relays, MagicDNS, an identity story, and a pile of extras that only exist because a company staffs them: SSH, Taildrop polish, Mullvad exits, app-store-friendly login, support, and a UI your relatives can finish without a CLI.

Headscale implements the coordination server. You point Tailscale clients at your URL. You manage users and nodes with a CLI or a third-party UI you now also operate. You can run your own DERP. You can serve MagicDNS. You cannot download Tailscale-the-company. People skip that sentence and then write a disappointed comment when SSO login is not a checkbox.

The data plane can keep working for a while if the coordinator dies. Existing WireGuard sessions do not instantly evaporate. New devices cannot join. Key expiry becomes a brick. ACL edits do not propagate. A phone that went to sleep and forgot its peers may not come back cleanly. Households experience this as “the mesh is flaky” rather than “I took the control plane offline to move a container.”

The household constraint Tailscale is built for

A household tailnet is four to twelve devices, two or three humans, and at least one person who will not read a README. The jobs are boring: reach the home assistant UI from a train, send a file to a desktop, keep a travel laptop on the same name system as the Pi.

Tailscale’s control plane is the reason that works when you are not home. Someone else runs the coordinator in multiple regions. Login is an OAuth flow a non-admin has already done for email. Adding a new iPhone is a store download and an invite. When it breaks, the outage is on status.tailscale.com and you are not the only person who can interpret it.

You pay for that with an account, a policy you did not write, and metadata that leaves your house. Device names, roughly who is online, and the fact that you run a tailnet sit on someone else’s metal. For a lot of families that is an acceptable trade, the same way using iCloud is an acceptable trade. For some it is the whole reason they opened the Headscale docs.

Pricing anxiety is a real household feeling even when you are still in a free tier. People self-host to escape a future invoice. That is a valid motive. It is not the same as having a replacement for the invite flow.

The Headscale tax that does not show up in the README

Standing up Headscale on a Saturday is easy if you already speak reverse proxies. A container, a domain, a certificate, a SQLite file, a first user. The tax starts on Sunday when a human who is not you has to enroll.

Official mobile apps expect Tailscale’s servers. Pointing them at Headscale is a custom-server dance that changes with app versions and OS policy. I have done it. I have also watched a relative bounce off it and install the app in default mode, then wonder why they cannot see the NAS. There is no household-grade “scan this QR and you are on our coordinator” that matches the official product. You will become the IT desk.

Preauth keys are the actual access-control system for many Headscale homes. They work. They also expire, get pasted into the wrong machine, and live in a notes app. Tailscale’s invite link is a product. Your notes app is a liability.

Updates are a compatibility matrix. Headscale lags or leads the client protocol. A client update from an app store can land while you are asleep. Tailscale-the-company ships both sides. You ship one side and hope the other still speaks the same language. Pinning client versions on phones is a fantasy. Your Headscale pin is not.

ACLs are another dialect. If you copied a GitHub gist, you will eventually deny yourself from SSH and spend an evening in JSON. Tailscale’s ACL UI will not save you from a bad policy, but it will show you the policy. Headscale will show you a file and a restart.

When the control plane belongs at home

Run Headscale when the coordinator is the asset you did not want to rent. That is a narrower case than “I like self-hosting.”

You have a threat model that includes Tailscale-the-company as an observer of metadata. You already accept that clients still talk to the internet and that DERP, if you use Tailscale’s, is still their network. Self-hosting DERP as well is the consistent version of this decision. It is also another service that must stay up on weird ports through residential NAT.

You have a lab tailnet that must not share an identity provider with your job. People mix personal and work devices on one Tailscale account and then do a messy offboarding. Headscale lets you keep a completely separate namespace on a box you wipe when the experiment ends.

You are comfortable being the only person who can recover it. That is the line. If your household needs the mesh while you are in the air, the coordinator needs to be as boring as the router: monitored, backed up, restorable from a dump you have actually applied. A SQLite file on the same disk as the latest Linux ISO is not a control plane. It is a hobby.

You do not need the extras. No Mullvad-from-the-admin-console. No expectation that Taildrop will feel official. No requirement that a contractor log in with their Google workspace and vanish when they lose the account. Those extras are why Tailscale invoices exist. If you do not use them, you are not leaving much on the table except reliability and UX.

When paying Tailscale is the adult household move

Pay when there is a human who should never see a preauth key. Partners, parents, teenagers with new phones. The product is the enrollment, not the WireGuard.

Pay when you travel and the mesh is how you reach cameras or a home assistant. Headscale on a home IP, even behind a tunnel, is a dependency chain: power, ISP, dynamic DNS, proxy, certificate, container. Tailscale’s coordinator being up is a dependency you already chose when you used the client. Adding four more is how “we cannot see the cameras” becomes a vacation event.

Pay when you want someone to have already solved DERP near the cafe you are sitting in. You can run a DERP on a $5 VPS. You should, if you are serious about Headscale. Most households do not, then complain that phones only connect at home.

Pay when the alternative is you writing internal docs. If you need a wiki page titled “How to add your phone,” you have already lost the household test. Tailscale’s docs are public and match the app. Yours will drift.

A practical split I will defend

Two tailnets. It sounds like overhead. It is less overhead than teaching Headscale to people who wanted a VPN button.

Household devices that other people touch stay on Tailscale SaaS. Phones, a shared iPad, a travel laptop that is not a lab experiment. Invites, key expiry, and support are the features.

Lab nodes stay on Headscale: hypervisors, CI runners, a subnet router that should not appear in a consumer admin UI next to a kid’s phone. I am the only admin. I accept that if Headscale is down, the lab is down, and the family still has a path to the printer.

Do not dual-home the same phone to both and then debug which interface won. Do not name both tailnets something cute that autocorrects into each other. I have done that. The ticket was not cute.

If you can only run one, run Tailscale SaaS for a household. Run Headscale for a lab. Reverse that only when you have monitoring, a documented enroll path that a non-admin has executed without you in the room, and a restore drill for the coordinator database. Until those three exist, you do not have a self-hosted Tailscale. You have a project.

Failure modes that look like “mesh is unreliable”

Certificate expiry on the Headscale URL. Clients stop trusting the coordinator. Existing sessions linger. New ones fail. You will blame NAT.

Clock skew on a Pi. Tokens and TLS get weird. You will blame the app.

An app update that expects a newer coordinator. Half the devices work. You will blame “Android.”

A reverse proxy that buffers WebSockets or strips a header the client needs. Intermittent joins. You will blame Wi-Fi.

Disk full on the SQLite volume. Coordinator wedged. You will blame Tailscale, out of habit, in a chat that is not even their product.

These are control-plane failures. They are not WireGuard failures. Treating them as “the VPN is down” is how you spend a night restarting clients instead of reading a log on port 8080.

The trade-off, said without romance

Tailscale sells a control plane that is boring for households and visible to a company. Headscale sells a control plane that is yours and boring only if you make it boring. The mesh between devices is similar enough that comparing handshake times is a distraction.

If you want fewer observers, self-host the coordinator and the relays, monitor them, and accept that you are now a tiny SaaS operator for your own family. If you want fewer 11 p.m. enrollments, pay Tailscale and keep Headscale for machines that do not have feelings.

The control plane is the product. The clients are just how you notice when it is gone.