Packages Install Versions Source Pricing FAQ
Get a subscription

Free mirror

⚑ 53 developer tools, always updated, new upstream releases land in apt within hours. Join the Discord

πŸ“… From , the apt mirror will require a subscription. See pricing Β· πŸ†“ There is an always-free mirror

πŸ•ΈοΈ Install Latest Headscale on Debian

Self-hosted implementation of the Tailscale control server

Latest version: 0.29.3 Β· updated 2026-07-29
SourceVersion
deb.griffo.io0.29.3 βœ…
Official Debian🚫 not packaged
← Back to home

What is Headscale?

Headscale is an open-source, self-hosted implementation of the Tailscale control server. It lets you run your own coordination server for a private WireGuard-based mesh network, so your devices can connect securely to each other without depending on Tailscale’s hosted control plane, while still using the standard Tailscale clients.

πŸš€ Why Latest Versions Matter: Headscale evolves alongside the Tailscale protocol, adding support for new client features, ACL improvements and stability fixes. Running the latest version keeps you compatible with current Tailscale clients.

⚑ Key Features of Headscale

πŸ” Self-hosted Control Plane

Run your own coordination server, no reliance on a third-party hosted service.

🌐 WireGuard Mesh

Fast, encrypted peer-to-peer connectivity between all your devices.

πŸ“± Standard Clients

Works with the official Tailscale clients on desktop, mobile and servers.

πŸ“œ ACL Policies

Fine-grained access control rules to segment and secure your network.

🎯 Why Headscale?

  • Full control: Own the coordination server and your network data
  • No vendor lock-in: Open source alternative to the hosted control plane
  • Uses official clients: Keep the polished Tailscale app experience
  • Lightweight: A single Go binary that is easy to deploy

πŸ†• Highlights

πŸ“¦ Installation from deb.griffo.io

Run the commands

Step 1: Add Repository

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
sudo apt update
install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
apt update
sudo apt install extrepo
sudo extrepo enable griffo
sudo apt update

πŸ†“ There is an always-free mirror. deb-free.griffo.io serves packages free forever, no account, no subscription, at most 2 months behind upstream, security fixes immediately. It currently carries cliamp, Ghostty, lazydocker, Oh My Posh and Zed; Headscale is not one of them, so the repository above is the only way to get it today, ask and it can be enrolled.

How the free mirror works β†’

🧩 About the extrepo option. extrepo is Debian's own tool for external repositories: it writes the sources file and installs the signing key for you, checking the key against signed metadata first. This repository is registered with it as griffo, and the always-free mirror as griffo-free, so on Debian (bookworm, trixie, forky and sid) the commands above are the whole setup.

extrepo sets up the sources file and the key only, so a subscription's credentials still go in /etc/apt/auth.conf.d/deb.griffo.io.conf. Ubuntu is not covered, because extrepo publishes metadata for Debian suites only: there, use the sudo or root commands.

Step 2: Install headscale

# Install latest headscale
sudo apt install headscale

# Verify installation
headscale version
# Install latest headscale
apt install headscale

# Verify installation
headscale version

🎯 Basic Usage Examples

# Show version
headscale version

# Create a user
headscale users create alice

# Generate a pre-auth key for a user
headscale preauthkeys create --user alice --reusable

# List connected nodes
headscale nodes list

# Serve the control server
headscale serve

πŸš€ Why Choose deb.griffo.io?

πŸ“Š Repository Comparison:
  • Official Debian: Often months behind, missing latest features
  • deb.griffo.io: Latest version within hours of release
  • Manual Installation: Manual downloads and PATH setup required
  • Our Repository: Pre-built, ready-to-use packages

πŸ“¦ Package Build Repository

The Debian packages are automatically built and maintained in this GitHub repository:

πŸ”— Related Packages

Also available from deb.griffo.io:

🎯 Perfect for: Self-hosters and organizations that want a private, secure mesh VPN using the Tailscale clients but with full control over the coordination server and their data.

πŸ’ Support This Project

If this repository saves you time and effort, please consider supporting it!

⭐ Star on GitHub 🐦 Share on Twitter

Just after the command? See apt install headscale, one page covering Debian and Ubuntu.

πŸ“¦ Recent releases from this repository

❓ Frequently asked questions

Is Headscale in the official Debian repositories?

No, Headscale is not packaged in the official Debian archives. This repository is currently the only apt source, serving Headscale 0.29.3.

How do I install the latest Headscale on Debian?

Add the deb.griffo.io repository once using the instructions above, then run: sudo apt install headscale. New releases arrive through the normal sudo apt upgrade.

Are the packages signed and how are they built?

Every package is signed with the repository's GPG key (EA0F721D231FDD3A0A17B9AC7808B4DD62C41256) and built from upstream releases in public GitHub packaging repositories that anyone can inspect.

Which Debian releases are supported?

Debian 12 Bookworm, Debian 13 Trixie, Forky and Sid.