PrivScale is my own self-hosted mesh network — every laptop, server, phone, and sensor I own, joined into one encrypted overlay. It's built entirely on two projects I don't own or speak for: Headscale as the self-hosted control plane, and Tailscale's client software and protocol carrying the traffic. These pages are the runbooks I used to build it, shared in case they save someone else the trial and error.
Three layers, in the order traffic actually takes: a control plane that introduces devices to each other, an encrypted overlay that carries the traffic, and the endpoints that make up your network.
An open-source, self-hosted implementation of the Tailscale control server. It handles device registration, key exchange, and ACLs — but carries none of your actual traffic.
Once introduced, devices negotiate direct WireGuard tunnels wherever NAT allows, falling back to a relay only when a direct path can't be found.
Workstations, phones, cloud VPS instances, home servers, and single-board devices all register as nodes on the same private address space.
Your network isn't one kind of device. PrivScale doesn't assume it is.
The overlay protocol — Tailscale's — is the same either way. What changes is who runs the coordination server. PrivScale is my instance of Headscale, standing in for Tailscale's hosted one.
This is what PrivScale runs.
Two playbooks covering both sides of a self-hosted mesh: standing up the control plane, and joining a VPS to it as an exit node.
Stand up your own Headscale control plane on a single VPS — Docker Compose, Traefik, and Let's Encrypt, with Headscale-UI for day-to-day admin and an optional tailnet-only lockdown of the web UI.
Join a VPS to an existing Headscale server as an exit node — fresh-install steps, backup/restore across a rebuild, route approval, and throughput tuning.
PrivScale is the name of my own deployment and this guide to building one — nothing here is official documentation, and nothing here is a product. All credit for the actual software goes to the two projects below.
PrivScale is an independent, personal deployment and an unofficial guide. It is not affiliated with, endorsed by, or sponsored by Tailscale Inc. or the Headscale maintainers. If anything here conflicts with the official docs, trust the official docs — check them before a fresh deploy, since both projects move fast.