Tailgate: Self-Hosted Tailscale Orchestration for Private Networks
Deploy official Tailscale clients with your own Headscale server and private DERP relays.
1Self-Hosted Network Orchestration
Tailgate enables users to run official Tailscale applications against a private Headscale server and custom DERP relays. It provides a structured management layer for checked configurations, pinned builds, and private HTTPS access. By centralizing control, it ensures that no traffic or coordination data leaves the user's defined infrastructure boundaries.
2Maintaining Official Client Integrity
The system utilizes unmodified official Tailscale clients on all connected devices. Tailgate does not fork or patch the underlying networking code, ensuring that WireGuard encryption remains intact. It pins exact versions and verifies checksums, allowing users to leverage professional-grade security tools while maintaining complete sovereignty over their private coordination plane.
3Configuration and Validation Workflow
Users define their network architecture, including domains, relays, and services, within a single JSON file. The Tailgate tool validates this configuration before deployment to ensure structural integrity. Once validated, it renders the necessary bundle, including Nginx configurations and service files, which are then manually installed on the chosen host infrastructure.
4Private HTTPS and Service Access
Each service operates on an overlay address via port 443, secured by publicly trusted certificates obtained through DNS challenges. Browsers recognize these certificates, yet the services remain unreachable from the public internet. Access is strictly managed through a console, ensuring that only authorized devices can reach specific internal network services.
5Traffic Routing and DERP Relays
Devices communicate directly using WireGuard encryption whenever possible. When direct paths are unavailable, traffic is routed through the user's own DERP relays. These relays function as blind conduits, as they cannot decrypt the packets they carry. The control plane facilitates these introductions without ever carrying the actual application traffic.
6Security and Identity Management
Device keys are generated locally on each client, with Headscale only handling the public halves. Tailgate never interacts with private keys. Identity verification is handled via Google sign-in, which is processed by a small, readable console component. This design minimizes the attack surface by keeping sensitive cryptographic operations off the server.
7Operational Requirements and Costs
Tailgate is free and open-source, but hosting it requires resources. Users must provide their own virtual machines, domain names, and DNS infrastructure capable of handling certificate challenges. Because the system is self-hosted, the responsibility for patching, backups, and maintaining relay uptime rests entirely with the administrator of the network.
8Strategic Network Sovereignty
By decoupling the control plane from hosted services, Tailgate offers a robust solution for teams requiring strict data residency and network isolation. It bridges the gap between the ease of use of official Tailscale apps and the security requirements of self-hosted infrastructure, providing a transparent, auditable, and highly controlled networking environment.