Self-hosted Tailscale control server, configured entirely through environment variables. Embedded DERP and STUN are off (the platform has no UDP), so clients relay through the public Tailscale DERP map over HTTPS. Create users and pre-auth keys with the CLI in the container (headscale users create, headscale preauthkeys create).
This page describes the Levelrail template for Headscale (Infrastructure). It deploys the services below as one Docker Compose app on your own server. Project site: https://headscale.net/stable/.
Recommended memory: about 256 MiB.
Services, ports and volumes
Environment variables
Passwords and keys marked as generated are created for you when the app is deployed and stored as secrets. Values are not shown here.
Security and requirements
Level: Standard.
What this template needs:
- Stores data in named volumes (
headscale): data.
What Levelrail adds around it:
- Automatic HTTPS and an ingress shield in front of every domain.
- Named volumes can be backed up and restored.
- Deploys are gated on the health check before traffic switches.
- One-step rollback to the previous revision.
- Exposure report shows what is reachable from outside.
- Host firewall rules managed for published ports.
Deploy Headscale with Levelrail
In the dashboard, open Apps, choose New app, then Browse templates, and select Headscale. Review the Compose body and deploy.
With the CLI:
See the service template catalog for how templates work, and Getting started if you have not installed Levelrail yet.
More Infrastructure templates
All templates are listed in the self-host gallery. Last modified on October 30, 2026
Get started
How-to guides
Reference
Concepts
Self-host gallery
Appendix