Headscale

No entries match these filters. Clear filters

1. v0.29.7 Oct 30, 2026 · issue 126

   Headscale v0.29.7 adds SSH agent and port forwarding controls and tightens metrics, registration, and route-serving security⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSIONDockergit

   Docker copy

   $ docker pull ghcr.io/juanfont/headscale:v0.29.7

   git copy

   $ git clone --branch v0.29.7 https://github.com/juanfont/headscale.git
   # already have the repo? check out this version:
   $ git checkout v0.29.7

   published under the project's GitHub account · checked 31 Oct

   └──▷ USE IT
   Lock down SSH agent and port forwarding on a node exposed to untrusted users via Tailscale SSH.
   /etc/default/tailscaled copy

   # In the tailscaled systemd service override or environment file:
   TS_SSH_DISABLE_FORWARDING=1

   Restrict Headscale metrics so they are only reachable on the local management interface, not through the Noise protocol.
   /etc/headscale/config.yaml copy

   metrics_listen_addr: '127.0.0.1:9090'

   • Disable SSH agent and port forwarding on a node by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment; applies to all Tailscale SSH sessions on that node and works on older clients too.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Metrics are no longer exposed to unregistered clients through the Noise protocol and remain available only on the configured metrics_listen_addr; setting metrics_listen_addr to empty disables the listener entirely.
   • Re-registering an expired tagged node now requires a valid pre-auth key, and another user's key or login on a tagged machine now creates a new device for that user instead of re-authenticating the tagged node.
   • Pending registration capacity is now bounded: pending interactive registrations and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. logins are kept at capacity rather than evicted, new requests get a retry response, registered nodes keep capacity for SSH checks, and stored pending registration data is capped at 64 KiB (keeping tags and expiry), with oversized interactive registrations rejected.
   • Key expiry values outside the years 0–9999 UTC are now refused at registration, on the OIDC token-expiry path, and in headscale nodes expire / POST /api/v1/node/{node_id}/expire (HTTP 400).

   +3 more show less

   • Client reports are now bounded to the first 256 endpoints and 4096 announced routes, with oversized hostnames, requested tags, or other metadata returning a registration error or HTTP 413 on map updates and zoned IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. endpoints refused; at startup, Headscale trims stored hostnames, endpoints, and routes to these limits and removes zoned endpoints.
   • A stalled request body, or a Noise tunnel with no open request, is now closed after 30 seconds.
   • SSH policy acceptEnv now works correctly, allowing configured environment variables to reach SSH sessions (upgrade SSH destination nodes to Tailscale v1.104.4 or newer before using acceptEnv, as older clients can disclose forwarded values).
   • Disable SSH agent and port forwarding on a node by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment; applies to all Tailscale SSH sessions on that node and works on older clients too.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   7 more in Everything

2. v0.29.4 Sep 23, 2026 · issue 084

   Headscale v0.29.4 adds mapper and node-store metrics and reduces peer-map rebuild churn via node-ID keying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.29.4 https://github.com/juanfont/headscale.git
   # already have the repo? check out this version:
   $ git checkout v0.29.4

   • Adds headscale_mapper_changes_dropped_total and headscale_ha_health_updates_total Prometheus metrics to track suppressed no-op map updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds headscale_nodestore_snapshot_builds_total Prometheus metric to track peer-map snapshot rebuilds.
   • Peers the peer map by node ID and reuses it for writes that cannot change peer visibility, so routine map requests no longer trigger a full rebuild.
   • Adds headscale_mapper_changes_dropped_total and headscale_ha_health_updates_total Prometheus metrics to track suppressed no-op map updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds headscale_nodestore_snapshot_builds_total Prometheus metric to track peer-map snapshot rebuilds.

   1 more in Everything

3. v0.29.0 Jun 17, 2026 · release notes

   Headscale v0.29.0 adds SSH check-mode auth, policy tests, grants, nodeAttrs, Taildrive, and HA subnet router probing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.29.0 https://github.com/juanfont/headscale.git
   # already have the repo? check out this version:
   $ git checkout v0.29.0

   └──▷ TRY IT
   Approve a pending SSH check-mode authentication request from the CLI without waiting for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user..
   copy

   $ headscale auth approve --auth-id <id>

   Validate that a policy change won't break existing reachability assertions before applying it.
   copy

   $ headscale policy check

   Disable HA subnet router probing when you want to rely solely on disconnect-based failover.
   yaml copy

   node:
     routes:
       ha:
         probe_interval: 0

   • Adds SSH check action support: when a policy rule uses "action": "check", connecting users must authenticate via OIDC or CLI approval before SSH access is granted.
   • New headscale auth CLI command group with approve, reject, and register subcommands for managing pending SSH-check and web-auth flows.
   • Evaluates the tests block in policy files (beta): reachability assertions run on headscale policy set, SIGHUP reload, and headscale policy check, rejecting bad policy before it is applied.
   • Evaluates the sshTests block in policy files (beta): per-SSH-rule accept/deny/check reachability assertions with the same rejection semantics as the tests block.
   • Supports Tailscale grants in policy files, enabling application-level controls (app field for Taildrive, peer relay) and traffic steering (via field for subnet routers/exit nodes) alongside ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource..

   +7 more show less

   • Adds autogroup:danger-all as a source that resolves to 0.0.0.0/0 and ::/0 for policies that need to match all IPs including non-Tailscale addresses.
   • Supports nodeAttrs block in ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. policy files to assign Tailscale node capabilities (e.g. disable-captive-portal-detection, nextdns:<profile>, drive:share, drive:access) to targeted nodes.
   • Adds top-level randomizeClientPort policy field to control per-node client port randomization tailnet-wide.
   • Adds auto_update.enabled config option to set the tailnet-wide default for client auto-update via CapMap.
   • Taildrive file-sharing is now configurable through policy using drive:share/drive:access node attributes and tailscale.com/cap/drive grants.
   • Hostname sanitisation now uses Tailscale's MagicDNS rules, allowing previously-rejected hostnames with apostrophes, special characters, and dots to register successfully.
   • Enforces a strict one-minor-version-at-a-time upgrade path; skipping minor versions or downgrading is now blocked at startup.

   12 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Wildcard (*) in ACL sources and destinations now resolves to the Tailscale CGNAT range (100.64.0.0/10) and ULA range (fd7a:115c:a1e0::/48) instead of all IPs (0.0.0.0/0 and ::/0); policies that need to match all IPs must use autogroup:danger-all as a source or explicit CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges as destinations.
   • !The randomize_client_port server-config key is removed; headscale refuses to start when it is set. Move the toggle to the policy file as the top-level randomizeClientPort field.
   • !The GivenName collision suffix changed from an 8-char random hash (laptop-abc12xyz) to a monotonic numeric suffix (laptop-1, laptop-2, …); MagicDNS names change on upgrade for any node whose label was previously in random-suffix form.
   • !Empty or all-non-ASCII hostnames now resolve to the literal node instead of invalid-<rand>.
   • !proto:icmp now matches only ICMPv4 (protocol 1); it no longer includes ICMPv6. Use proto:ipv6-icmp or protocol number 58 for ICMPv6.
   • !Tags, hosts, and IP addresses are now rejected as sources for autogroup:self destinations; policies using them will fail validation.
   • !Skipping minor versions (e.g. 0.27 → 0.29) or downgrading to a previous minor version is blocked; upgrade one minor version at a time.
   • !Minimum supported Tailscale client version is now v1.80.0.
4. v0.29.0 Jun 17, 2026 · issue 007

   Headscale v0.29.0 adds SSH check-mode auth, policy tests, grants, Taildrive, nodeAttrs, and HA subnet router health probing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.29.0 https://github.com/juanfont/headscale.git
   # already have the repo? check out this version:
   $ git checkout v0.29.0

   └──▷ TRY IT
   Approve a pending SSH check-mode or web auth request identified in server logs, granting the user access without re-keying.
   copy

   $ headscale auth approve --auth-id <id>

   Validate a policy file's tests and sshTests blocks before pushing it live, catching reachability regressions without affecting running nodes.
   copy

   $ headscale policy check

   • New headscale auth CLI command group: approve, reject, and register subcommands manage SSH check-mode and web auth approval flows.
   • Supports Tailscale SSH "action": "check" rules, prompting OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. or CLI approval before granting SSH access to a node.
   • Evaluates the tests block in policy files (beta), asserting reachability between sources and destinations; failing tests block writes before they are applied.
   • Evaluates the sshTests block in policy files (beta), asserting SSH reachability with accept, deny, and check user lists per source/destination pair.
   • Adds support for Tailscale Grants (grants block in policy), enabling application-level controls like Taildrive file sharing and traffic steering via tagged subnet routers or exit nodes.

   +12 more show less

   • Introduces autogroup:danger-all as a source-only ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. target resolving to all IPs (0.0.0.0/0 and ::/0), replacing the prior behavior of wildcard *.
   • New nodeAttrs policy block distributes Tailscale node capabilities (e.g., disable-captive-portal-detection, nextdns:<profile>, drive:share, drive:access) to matched nodes.
   • Adds randomizeClientPort as a top-level policy file field (replaces removed randomize_client_port server-config key).
   • New auto_update.enabled config option sets the tailnet-wide default for client auto-update via CapMap.
   • Taildrive file-sync is now configurable through policy using drive:share, drive:access nodeAttrs and tailscale.com/cap/drive grants.
   • Hostname sanitisation now uses Tailscale's MagicDNS rules, supporting hostnames with apostrophes, special characters, and non-ASCII characters.
   • GivenName collision suffix changed from random 8-char hash to monotonic numeric suffix (laptop, laptop-1, laptop-2, …), matching Tailscale SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally..
   • BREAKING: proto:icmp now covers only ICMPv4; use proto:ipv6-icmp or protocol 58 for ICMPv6.
   • BREAKING: autogroup:self destinations now reject tags, hosts, and IPs as sources, matching Tailscale validation.
   • BREAKING: Headscale enforces a strict sequential upgrade path — skipping minor versions (e.g., 0.27 → 0.29) and downgrading are blocked.
   • BREAKING: randomize_client_port server-config key removed; headscale refuses to start if the old key is present — move it to the policy file.
   • Raises minimum supported Tailscale client version to v1.80.0.

   17 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !MagicDNS GivenName collision suffix changed from 8-char random hash (laptop-abc12xyz) to monotonic numeric suffix (laptop, laptop-1, laptop-2, …); MagicDNS names change on upgrade for any node whose previous label was a random-suffix form
   • !Empty or all-non-ASCII hostnames now fall back to the literal node instead of invalid-<rand>
   • !Wildcard (*) in ACL sources and destinations now resolves to the Tailscale CGNAT range (100.64.0.0/10) and ULA range (fd7a:115c:a1e0::/48) instead of all IPs (0.0.0.0/0 and ::/0); policies relying on * to match all IP addresses must switch to autogroup:danger-all (source only) or explicit CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges (destinations)
   • !Policies using tags, hosts, or IP addresses as sources for autogroup:self destinations now fail validation
   • !proto:icmp now only includes ICMPv4 (protocol 1); ICMPv6 must be specified explicitly as proto:ipv6-icmp or protocol number 58
   • !Skipping minor versions (e.g. 0.27 → 0.29) is blocked; upgrades must proceed one minor version at a time, and downgrading to a previous minor version is blocked
   • !The randomize_client_port server-config key was removed; headscale refuses to start when the old key is present — the toggle must be moved to the policy file as the top-level randomizeClientPort field
   • !Minimum supported Tailscale client version is now v1.80.0
5. v0.29.0 Jun 17, 2026 · issue 001

   Headscale v0.29.0 adds SSH check-mode auth, policy tests, grants, Taildrive, nodeAttrs, and HA subnet router health probing.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.29.0 https://github.com/juanfont/headscale.git
   # already have the repo? check out this version:
   $ git checkout v0.29.0

   └──▷ TRY IT
   Approve a pending SSH check-mode or web auth request identified in server logs, granting the user access without re-keying.
   copy

   $ headscale auth approve --auth-id <id>

   Validate a policy file's tests and sshTests blocks before pushing it live, catching reachability regressions without affecting running nodes.
   copy

   $ headscale policy check

   • New headscale auth CLI command group: approve, reject, and register subcommands manage SSH check-mode and web auth approval flows.
   • Supports Tailscale SSH "action": "check" rules, prompting OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. or CLI approval before granting SSH access to a node.
   • Evaluates the tests block in policy files (beta), asserting reachability between sources and destinations; failing tests block writes before they are applied.
   • Evaluates the sshTests block in policy files (beta), asserting SSH reachability with accept, deny, and check user lists per source/destination pair.
   • Adds support for Tailscale Grants (grants block in policy), enabling application-level controls like Taildrive file sharing and traffic steering via tagged subnet routers or exit nodes.

   +12 more show less

   • Introduces autogroup:danger-all as a source-only ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. target resolving to all IPs (0.0.0.0/0 and ::/0), replacing the prior behavior of wildcard *.
   • New nodeAttrs policy block distributes Tailscale node capabilities (e.g., disable-captive-portal-detection, nextdns:<profile>, drive:share, drive:access) to matched nodes.
   • Adds randomizeClientPort as a top-level policy file field (replaces removed randomize_client_port server-config key).
   • New auto_update.enabled config option sets the tailnet-wide default for client auto-update via CapMap.
   • Taildrive file-sync is now configurable through policy using drive:share, drive:access nodeAttrs and tailscale.com/cap/drive grants.
   • Hostname sanitisation now uses Tailscale's MagicDNS rules, supporting hostnames with apostrophes, special characters, and non-ASCII characters.
   • GivenName collision suffix changed from random 8-char hash to monotonic numeric suffix (laptop, laptop-1, laptop-2, …), matching Tailscale SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally..
   • BREAKING: proto:icmp now covers only ICMPv4; use proto:ipv6-icmp or protocol 58 for ICMPv6.
   • BREAKING: autogroup:self destinations now reject tags, hosts, and IPs as sources, matching Tailscale validation.
   • BREAKING: Headscale enforces a strict sequential upgrade path — skipping minor versions (e.g., 0.27 → 0.29) and downgrading are blocked.
   • BREAKING: randomize_client_port server-config key removed; headscale refuses to start if the old key is present — move it to the policy file.
   • Raises minimum supported Tailscale client version to v1.80.0.

   17 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !MagicDNS GivenName collision suffix changed from 8-char random hash (laptop-abc12xyz) to monotonic numeric suffix (laptop, laptop-1, laptop-2, …); MagicDNS names change on upgrade for any node whose previous label was a random-suffix form
   • !Empty or all-non-ASCII hostnames now fall back to the literal node instead of invalid-<rand>
   • !Wildcard (*) in ACL sources and destinations now resolves to the Tailscale CGNAT range (100.64.0.0/10) and ULA range (fd7a:115c:a1e0::/48) instead of all IPs (0.0.0.0/0 and ::/0); policies relying on * to match all IP addresses must switch to autogroup:danger-all (source only) or explicit CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges (destinations)
   • !Policies using tags, hosts, or IP addresses as sources for autogroup:self destinations now fail validation
   • !proto:icmp now only includes ICMPv4 (protocol 1); ICMPv6 must be specified explicitly as proto:ipv6-icmp or protocol number 58
   • !Skipping minor versions (e.g. 0.27 → 0.29) is blocked; upgrades must proceed one minor version at a time, and downgrading to a previous minor version is blocked
   • !The randomize_client_port server-config key was removed; headscale refuses to start when the old key is present — the toggle must be moved to the policy file as the top-level randomizeClientPort field
   • !Minimum supported Tailscale client version is now v1.80.0
6. v0.28.0 Feb 4, 2026 · release notes

   Headscale v0.28.0 brings Tailscale-model tag identity, partial map updates, bcryptbcryptA deliberately slow password-hashing function, so a stolen password database takes far longer to crack by guessing. Argon2 and scrypt are newer alternatives built on the same idea. PreAuthKeys, and Taildrop toggle.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.28.0 https://github.com/juanfont/headscale.git
   # already have the repo? check out this version:
   $ git checkout v0.28.0

   └──▷ TRY IT
   Register an infrastructure node as tagged (server identity) rather than user-owned using a tagged PreAuthKey.
   copy

   $ headscale preauthkeys create --reusable --tags tag:server

   Expire or delete a PreAuthKey by ID now that user+key combinations are no longer accepted.
   copy

   $ headscale preauthkeys expire --id 123
   headscale preauthkeys delete --id 123

   • Adds Tailscale-compatible tag identity: tagged devices receive identity from tags instead of users, with tags validated against tagOwners policy at registration time.
   • Enables user-owned nodes to request tags at registration via --advertise-tags, with tags manageable post-registration via headscale nodes tag or the SetTags API.
   • Rewrites the map update system to send partial updates (endpoint/DERP changes, node removals) instead of full network maps, reducing bandwidth for large networks.
   • Secures PreAuthKeys with bcrypt hashing; full key shown only once at creation, with prefix-only display (hskey-auth-{prefix}-***) when listing.
   • Introduces new key prefixes: hskey-auth-{prefix}-{secret} for PreAuthKeys, hskey-api-{prefix}-{secret} for API keys, and hskey-reg-{random} for web registration keys.

   +9 more show less

   • Adds taildrop.enabled configuration option to enable or disable Taildrop file sharing.
   • Adds oidc.email_verified_required config option to control whether OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication requires a verified email address.
   • Allows tags to be listed as tagOwner of other tags in policy.
   • Allows disabling the metrics server by setting metrics_listen_addr to an empty string.
   • Adds IP reclamation from the IP allocator when nodes are deleted.
   • Adds NixOS module in the repository for deployment support.
   • Adds --id flag to API key expire/delete commands as an alternative to --prefix.
   • Redesigns OIDC callback and device registration web pages using the Material for MkDocs design system.
   • SSH policy now enforces Tailscale's security model: autogroup:member, autogroup:tagged, or specific tags must be used as SSH destinations instead of wildcard *; invalid policies are rejected at load time.

   14 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The ForcedTags, InvalidTags, and ValidTags fields have been removed from the Node message in the gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication./REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and replaced with a single Tags field; API clients must use Tags instead of ValidTags.
   • !The --tags flag has been removed from headscale nodes list; the Tags column is now always shown.
   • !headscale preauthkeys expire and headscale preauthkeys delete now require --id <ID> instead of --user <USER> <KEY>.
   • !headscale preauthkeys list now lists all keys across all users; the --user filter is removed.
   • !headscale preauthkeys create no longer requires --user (now optional).
   • !The headscale nodes move CLI command has been removed; nodes cannot be moved between users.
   • !The MoveNode API endpoint has been removed.
   • !Direct upgrades from databases created before version 0.25.0 are no longer supported; users must upgrade to 0.25.1 first.
   • !Wildcard (*) is no longer supported as an SSH destination in SSH policy; use autogroup:member, autogroup:tagged, or specific tags instead.
   • !SSH policy rules with tag:* or autogroup:tagged as source cannot have username destinations or autogroup:member/autogroup:self as destination; invalid policies are now rejected at load time.
   • !The oidc.email_verified_required option defaults to true, meaning OIDC authentication with unverified emails (previously allowed) will now be rejected with an unverified email error when oidc.allowed_domains or oidc.allowed_users is configured.
   • !The minimum supported Tailscale client version is now v1.74.0.
7. v0.27.1 Nov 11, 2025 · release notes

   Headscale v0.27.1 adds custom-timestamp node expiry and improves exit node ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. enforcement.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.27.1 https://github.com/juanfont/headscale.git
   # already have the repo? check out this version:
   $ git checkout v0.27.1

   • Supports expiring nodes with a custom timestamp, enabling precise lifecycle control over node access.
   • Distinguishes subnet routes from exit node routes internally, improving ACL granularity for exit node visibility.

   2 details in Everything

8. v0.27.0 Oct 27, 2025 · release notes

   Headscale v0.27.0 adds autogroup:self/member/tagged support, a new healthcheck command, in-memory node store, and policy direct-manipulation flag.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.27.0 https://github.com/juanfont/headscale.git
   # already have the repo? check out this version:
   $ git checkout v0.27.0

   • Adds support for autogroup:member and autogroup:tagged autogroups in ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. policy.
   • Adds experimental support for autogroup:self autogroup (may be expensive on large installations; report bugs).
   • Adds a healthcheck CLI command for checking instance health.
   • Adds a flag to directly manipulate policy stored in the database.
   • Adds in-memory NodeStore data structure to reduce database reads/writes and improve performance on read-heavy workloads.

   +5 more show less

   • Policy now rejects invalid/unknown fields, making spelling errors easier to detect.
   • DERPMap update mechanism now retries on failure and preserves the previous map if an update fails.
   • OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.: Group claims are now sourced from UserInfo, and user details are updated from UserInfo claims before evaluating allowed groups, email, and domain.
   • Adds /version HTTP endpoint to the headscale server.
   • Default derp.update_frequency changed from 24 hours to 3 hours for faster propagation of upstream DERP changes.

   10 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !32-bit binaries are no longer produced or supported.
   • !Policy: Zero or empty destination port is no longer allowed in ACL rules.
   • !Stricter hostname validation is enforced: hostnames must be 2–63 characters, alphanumeric and hyphens only, and cannot start or end with a hyphen. During client registration, invalid hostnames are automatically renamed to invalid-XXXXXX; during hostinfo updates and CLI operations, invalid hostnames are rejected with an error.
   • !Ubuntu 20.04 is no longer supported by the Debian/Ubuntu packaging.
   • !Policy v1 code has been removed.
   • !SQLite databases undergo a significant schema migration on upgrade — back up your db.sqlite (and WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites./SHM files) before upgrading.
   • !The minimum supported Tailscale client version is now v1.64.0.
9. v0.26.0 May 14, 2025 · release notes

   Headscale v0.26 rewrites route and policy internals, adds headscale nodes list-routes, approve-routes, and policy check commands.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.26.0 https://github.com/juanfont/headscale.git
   # already have the repo? check out this version:
   $ git checkout v0.26.0

   └──▷ TRY IT
   List all routes advertised by nodes and see which are approved and actively serving, so you can audit exit-node or subnet-router state at a glance.
   copy

   $ headscale nodes list-routes

   Approve specific routes (including dual-stack exit routes) for a node without touching the old route API.
   copy

   $ headscale nodes approve-routes --identifier 1 --routes 0.0.0.0/0,::/0

   Validate a policy file for v2 compliance before pushing it live, catching load-time errors (such as missing @ in usernames) without disrupting a running instance.
   copy

   $ headscale policy check --file policy.json

   • New headscale nodes list-routes command shows approved, available, and serving (primary) routes per node.
   • New headscale nodes approve-routes --identifier <id> --routes <cidrs> command replaces the old dedicated route API/CLI for managing node routes.
   • New headscale policy check --file <file> command validates a policy file for errors before loading it.
   • Routes are now managed via the Node API; route state is kept in-memory rather than a dedicated database table.
   • Expanded /debug endpoint now exposes running goroutines, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory profiles, config, policy, per-node SSH policy and filter, connected nodes, and DERPmap.

   +3 more show less

   • OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. integration now fetches UserInfo to populate email_verified, name, email, and username when the ID token omits them.
   • Restores support for Override local DNS behaviour.
   • Performance improvement: node update queries now fetch only nodes relevant to the requesting node.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The dedicated Route API and Route CLI (headscale routes …) have been removed; route management now goes through headscale nodes list-routes and headscale nodes approve-routes.
   • !Policy v2 is now the default: all usernames in policy rules must contain an @ character (e.g. john must be written as john@); policies that previously loaded but failed at runtime will now fail at load time.
   • !The oidc.map_legacy_users and oidc.strip_email_domain config keys have been removed.
   • !server_url and base_domain are no longer allowed to be equal.
   • !The pre-auth key API/CLI now uses the numeric ID instead of username to identify keys.
   • !The pre-auth key API now returns a full user object instead of a username string.
   • !Node FQDNs in the netmap now include a trailing dot (.), aligning with tailscale.com behaviour — clients that parse FQDNs without expecting a trailing dot may break.
10. v0.25.0 Feb 11, 2025 · release notes

    Headscale v0.25.0 rewrites auth flow, tightens pre-auth key lifecycle, and improves HTTP error reporting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.25.0

    • Registering a node with a new user now creates a distinct new node instead of reusing an existing one.
    • A logged-out node re-authenticating with the same user replaces the existing node entry.
    • Pre-auth keys belonging to a user are no longer deleted when the user is deleted.
    • Pre-auth keys actively used by a node can no longer be deleted.
    • Outdated nodes now display their Tailscale version instead of raw capability version numbers.

    +3 more show less

    • HTTP error responses overhauled to return more accurate status codes and descriptive messages.
    • Minimum hostname length reduced to 2 characters.
    • OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.-managed users can no longer be renamed via OIDC.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Tailscale clients older than version 1.62 (capability version 87) are no longer supported and will not be able to connect.
    • !oidc.map_legacy_users now defaults to false; existing deployments relying on legacy OIDC user mapping must explicitly set oidc.map_legacy_users: true to preserve prior behaviour.
    • !A node re-registered with a different (new) user is now registered as a brand-new node rather than updating the existing node record — existing node identities tied to user changes will be affected.
11. v0.24.0 Jan 17, 2025 · release notes

    Headscale v0.24.0 hardens OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. identity with iss/sub claims, adds PKCEPKCEProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier., SSH agent forwarding, and a new dns.extra_records_path option.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.24.0

    └──▷ USE IT
    After upgrading, let legacy OIDC users log in automatically while migration runs, then lock it down once all accounts are migrated.
    yaml copy

    # In your headscale config.yaml — keep migration on until all users have logged in:
    map_legacy_users: true
    
    # Once all users have authenticated, disable legacy matching:
    map_legacy_users: false

    Serve custom DNS records (e.g. internal service entries) by pointing Headscale to an external records file.
    yaml copy

    # In your headscale config.yaml:
    dns:
      extra_records_path: /etc/headscale/extra_records.json

    • Automatically syncs OIDC profile fields (email, name, preferred_username, picture) to Headscale user records on every login.
    • Adds map_legacy_users config option to automatically migrate existing OIDC accounts to the new iss/sub identity model.
    • Adds PKCE (Proof Key for Code ExchangeProof Key for Code ExchangeProof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier.) verifier support for OIDC authentication flows.
    • Allows nodes to use SSH agent forwarding.
    • Adds dns.extra_records_path configuration option for supplying additional DNS records.

    +3 more show less

    • Supports client certificate verification for DERP connections.
    • Improves built-in DERP server compatibility with clients connecting over WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output..
    • CLI user management commands now accept --identifier in addition to --name for referencing users by ID.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The dns.use_username_in_magic_dns configuration option has been removed; usernames in Magic DNS are no longer possible.
    • !Tailscale client versions older than 1.56 are no longer supported.
    • !GET /api/v1/user/{name} and the GetUser RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. have been removed; use ListUsers with an ID parameter instead.
    • !RenameUser and DeleteUser now require a user ID instead of a name.
    • !On OIDC migration, Headscale renames the account's username to preferred_username, which may break ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. or policies that match by username.
    • !map_legacy_users will default to false in v0.25.0 and the migration mechanism will be removed in v0.26.0; unmigrated users will receive new accounts.
12. v0.23.0 Sep 18, 2024 · release notes

    Headscale v0.23.0 adds SSH support, delta network updates, policy APIs, and API key deletion with significant breaking config changes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.23.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.23.0

    └──▷ USE IT
    Enable random IP allocation from separate v4/v6 prefix ranges instead of the old single ip_prefixes key.
    yaml copy

    prefixes:
      v4: 100.64.0.0/10
      v6: fd7a:115c:a1e0::/48
      allocation: random

    • Adds Tailscale SSH support, enabling SSH access control through Headscale policy.
    • Supports delta network map updates — nodes now receive only changed/added/removed node info instead of full network state on every update.
    • Adds real-time update delivery via go channels (notifier package), replacing fixed-interval polling for lower-latency propagation to connected clients.
    • New APIs for managing Headscale ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource./policy (read and write policy via API).
    • Adds support for deleting API keys.

    +10 more show less

    • Adds autogroup:internet group to policy, matching Tailscale's policy model.
    • Adds command to backfill IP addresses for nodes missing IPs from configured prefixes.
    • Supports manual DERP map entry creation with custom configuration instead of automatic generation only.
    • IP prefix configuration now split into separate prefixes.v4 and prefixes.v6 ranges, with new prefixes.allocation option supporting sequential or random IP assignment.
    • Write-ahead logging (WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites.) for SQLite is now on by default and configurable.
    • PostgreSQL database configuration gains new options for max open connections, idle connections, and idle connection lifetime.
    • CLI commands (all except serve) now require only minimal configuration — no errors or warnings from unset settings.
    • CLI results are now consistently sent to stdout and errors to stderr.
    • Logs are now sent to stderr by default.
    • HuJSON is now the sole supported format for Headscale policy files.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Database configuration structure has changed and the old structure has been removed — configuration must be converted to the new structure (see config-example.yaml).
    • !The API renames Machine to Node across all endpoints and responses.
    • !Tailscale clients older than version 1.42 are no longer supported.
    • !Headscale now fails to start if no DERP server is configured (cannot load DERPMap from file or URL).
    • !Embedded DERP server now requires a private key — add a filepath entry to derp.server.private_key_path in config.
    • !Docker container image entrypoint changed from shell to headscale binary — headscale serve must be changed to serve in container commands.
    • !Docker container no longer automatically creates /var/lib/headscale and /var/run/headscale directories.
    • !ip_prefixes config option is renamed to prefixes.v4 and prefixes.v6.
    • !MagicDNS domains no longer contain usernames by default — use use_username_in_magic_dns to restore old behavior (this option will be removed when tags are fixed).
    • !dns.base_domain can no longer be the same as or part of server_url.
    • !YAML format is no longer supported for Headscale policy files — HuJSON is now the only accepted format.
    • !DNS configuration has been restructured — review the new config-example.yaml for the updated layout.
13. v0.22.2 May 11, 2023 · release notes

    Adds Go profiling flags to enable pprof and fixes systemd service file location in .deb packages

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.22.2 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.22.2

    └──▷ USE IT
    Enable pprof profiling via environment variables for performance analysis.
    shell copy

    export HS_PPROF_ENABLED=true
    export HS_PPROF_ADDR=:6060
    headscale serve

14. v0.21.0 Mar 20, 2023 · release notes

    Adds configtest CLI command and route deletion capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.21.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.21.0

    └──▷ TRY IT
    Validate a configuration file without starting the server to catch syntax errors early
    copy

    $ headscale configtest --config /etc/headscale/config.yaml

    Delete a specific route from a node using the API endpoint
    copy

    $ curl -X DELETE http://localhost:8080/api/v1/routes/<route-id>

    • Adds configtest CLI command to validate configuration files before starting
    • Allows deleting routes via the management API

    2 details in Everything

15. v0.20.0 Feb 3, 2023 · release notes

    Split DNS configuration now works without global nameservers; exit node routes support simultaneous IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.20.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.20.0

    • Allow split DNS configuration without requiring global nameservers
    • Enable both exit node routes (IPv4 and IPv6) at the same time

    2 details in Everything

16. v0.18.0 Jan 14, 2023 · release notes

    Headscale v0.18.0 adds subnet router failover support and OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. AllowGroups configuration options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.18.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.18.0

    • Adds oidc.allow_groups config option to restrict access by group in the [auth] section of headscale.yaml
    • Enables subnet router failover via a reworked routing implementation, allowing multiple routes to be active for redundancy
    • Supports OIDC client secret from file via new config key oidc.client_secret_file alongside the existing oidc.client_secret option

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !db_ssl defaults to false instead of previous default; if your database requires SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination., you must explicitly set db_ssl = true in your config file.
17. v0.17.0 Nov 26, 2022 · release notes

    Headscale v0.17.0 adds TS2021 support, experimental SSH ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource., and new noise config

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.17.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.17.0

    • noise.private_key_path config key is now required to enable the new noise protocol
    • Added HEADSCALE_EXPERIMENTAL_FEATURE_SSH=1 environment variable to enable experimental SSH ACLs
    • Added HEADSCALE_CONFIG environment variable to specify custom config file location
    • Added dns_config.override_local_dns option for DNS configuration

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !noise.private_key_path is now a required config key for the new noise protocol
    • !Log level moved to log.level config section; log_level top-level key is removed
    • !Alpine Linux container image support removed
18. v0.16.4 Aug 21, 2022 · release notes

    Headscale v0.16.4 adds PostgreSQL TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.4 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.16.4

    • Adds ability to connect to PostgreSQL over TLS/SSL

    1 detail in Everything

19. v0.16.1 Aug 12, 2022 · release notes

    Headscale v0.16.1 adds PostgreSQL unix socket support and switches NodeKey as main identifier

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.1 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.16.1

    • Switches to using NodeKey as the primary identifier for nodes in registration protocol

    1 detail in Everything

20. v0.16.0 Jul 25, 2022 · release notes

    Headscale v0.16.0 adds node management CLI commands, SIGHUP ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. reloads, and new OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.16.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.16.0

    └──▷ TRY IT
    Migrate a node from one namespace to another via CLI
    copy

    $ headscale nodes move <node-key> --dest-namespace <target-namespace>

    Reload network policies without stopping the service
    copy

    $ kill -HUP $(pgrep headscale)

    • headscale nodes move command to migrate nodes between namespaces
    • headscale tags create command to assign tags to a node
    • headscale tags list command to view node tags
    • -c flag on the CLI to specify a custom config file path
    • allow_random_port configuration key allowing Tailscale clients to use random WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. ports

    +2 more show less

    • SIGHUP signal support for hot-reloading ACL policies without restart
    • New OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Connect configuration keys: scopes, freeform_parameters, domain, and user_allowlist

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Old ACL syntax using users and ports is removed; migrate to src and dst
    • !32-bit armhf binary builds are no longer published
21. v0.15.0 Mar 20, 2022 · release notes

    v0.15.0 adds YAML ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. support, embedded DERP/STUN server, and a /windows configuration endpoint

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.15.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.15.0

    • Adds metrics_listen_addr config key to .headscale/config.yaml for configurable metrics endpoint
    • Adds /windows API endpoint to return Windows configuration instructions and registry file download
    • Enables writing ACL files with YAML format instead of only JSON
    • Allows using emails in ACL groups

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Boundaries between Namespaces have been removed; all nodes can communicate by default. Use config.yaml ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. to limit access.
22. v0.14.0 Feb 24, 2022 · release notes

    Headscale v0.14.0 adds configurable mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. and rewrites ACLsACLsAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. to align with Tailscale

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.14.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.14.0

    • Adds support for configurable mTLS via the tls_client_auth_mode setting
    • Rewrites ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. engine to treat namespaces as Users and allow default inter-machine communication

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ACLs rewritten: Namespaces are now treated as Users, meaning all machines can communicate with all machines by default unless restricted via ACLs.
23. v0.13.0 Feb 18, 2022 · release notes

    Headscale v0.13.0 enables IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addressing and introduces API key authentication for both CLI and HTTP API access, moving away from the legacy ip_prefix config field.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.13.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.13.0

    └──▷ BREAKING ON UPGRADE

    • !ip_prefix in configuration is replaced by ip_prefixes; using the old key will no longer work.
24. v0.12.4 Jan 30, 2022 · release notes

    Adds headscale keys generate command and makes gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. Unix socket permissions configurable via grpc.socket.mode.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.4 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.12.4

    └──▷ USE IT
    Generate a new private key for headscale from the command line.
    shell copy

    headscale keys generate

    • Adds a new keys generate subcommand to create a private key for headscale.

    1 detail in Everything

25. v0.12.1 Dec 25, 2021 · release notes

    v0.12.1 adds a gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. server and HTTP API, plus beta OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.12.1 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.12.1

    • Adds a headscale gRPC server for CLI communication
    • Adds an HTTP API endpoint suite (currently disabled)
    • Adds beta OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. authentication support

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The private key format changes to match Tailscale 1.18; the old key file must be deleted and headscale restarted to auto-generate a new one
26. v0.11.0 Oct 25, 2021 · release notes

    Headscale v0.11.0 unifies DERP config into a single config.yaml and bundles certificates for DERP map discovery.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.11.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.11.0

    • Unifies derp.yaml into the main config.yaml, eliminating the need for multiple configuration files
    • Bundles TLS certificates in the Docker image to allow fetching the DERP map directly from Tailscale
    • Adds helper functions for building DERP maps from URLs or local files

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The separate derp.yaml file is removed; all DERP settings must now be defined in config.yaml according to the updated schema in /config-example.yaml
27. v0.10.5 Oct 20, 2021 · release notes

    Headscale v0.10.5 introduces Split DNS support, allowing node-specific DNS configuration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.5 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.10.5

    • Add support for Split DNS implements per-node or per-ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource.-based custom DNS resolver configuration.

    1 detail in Everything

28. v0.10.4 Oct 18, 2021 · release notes

    Adds headscale nodes unshare CLI subcommand and namespace renaming support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.4 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.10.4

    • Adds the headscale nodes unshare CLI command to remove a machine from a specific namespace
    • Adds headscale namespaces rename CLI command to change an existing namespace's name

    2 details in Everything

29. v0.10.3 Oct 16, 2021 · release notes

    Headscale v0.10.3 adds --force flag to node delete and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. binary support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.3 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.10.3

    └──▷ TRY IT
    Forcefully remove a node from the network regardless of its current state or locks.
    copy

    $ headscale node delete <node-id> --force

    • Adds --force flag to the node delete CLI subcommand to allow forced deletion of nodes.
    • Adds ARM64 binaries for Linux hosts.

    2 details in Everything

30. v0.10.2 Oct 13, 2021 · release notes

    Headscale v0.10.2 adds AlreadyUsed field to Auth Keys API and enables JSON output for node deletion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.2 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.10.2

    • Disables the version check mechanism when JSON output format is requested, preventing unwanted version mismatch warnings during automated deletions.

    1 detail in Everything

31. v0.10.0 Oct 10, 2021 · release notes

    Headscale v0.10.0 adds new MagicDNS capability for automated DNS name resolution across Tailnets

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    • MagicDNS: Enables Headscale to act as a MagicDNS server, allowing nodes in the Tailnet to resolve each other's hostnames automatically.
    • Adds automatic generation of MagicDNS search domains for any configured tailnet range (defaulting to 100.64.0.0/10).

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Headscale will now reject MagicDNS configuration if no DNS servers are explicitly set up.
32. v0.9.3 Oct 7, 2021 · release notes

    Headscale v0.9.3 adds ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. email/URL registration options, a disable-update-checks switch, Prometheus metrics, and multi-namespace state checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.3 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.9.3

    • Adds --acme-email and --acme-url configuration options to specify the ACME email address and URL for node registration
    • Adds --disable-update-checks CLI flag to disable automatic update checks at startup
    • Allows multiple namespaces to be checked for state simultaneously through expanded peer/state APIs

    3 details in Everything

33. v0.9.1 Sep 26, 2021 · release notes

    Headscale v0.9.1 adds Taildrop file transfer support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.1 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.9.1

    • Adds taildrop support for receiving files over the mesh network

    1 detail in Everything

34. v0.9.0 Sep 23, 2021 · release notes

    Adds JSON output for tailscale status and updates Tailscale client support to v1.14

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.9.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.9.0

    • Uses JSON output format for the internal tailscale status command instead of plain text.
    • Updates Tailscale library dependencies to version 1.14.

    2 details in Everything

35. v0.7.1 Aug 26, 2021 · release notes

    Adds DNSConfig field to configuration for defining DNS settings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.1 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.7.1

    • Adds DNSConfig field to the tool's configuration file.
    • Passes DNSConfig to nodes in MapResponse.

    2 details in Everything

36. v0.7.0 Aug 23, 2021 · release notes

    v0.7.0 adds --all flag to routes enable command and enhances route commands with ptables

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    └──▷ TRY IT
    Enable every available advertised route at once without listing them individually.
    copy

    $ headscale routes enable --all

    • Adds --all flag to the routes enable subcommand to enable all advertised routes in a single operation
    • Enhances route management commands with printable tables (ptables) support for multiple routes

    2 details in Everything

37. v0.6.0 Aug 12, 2021 · release notes

    New expire CLI command for pre-auth keys and /health endpoint added in v0.6.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    └──▷ TRY IT
    Expire a specific pre-auth key by its ID from the command line.
    copy

    $ headscale expire <key-id>

    Check if the Headscale service is responding correctly by querying the health endpoint.
    copy

    $ curl http://<host>:<port>/health

    • headscale expire subcommand allows expiring preauth keys via CLI
    • /health HTTP endpoint added to the service

    2 details in Everything

38. v0.3.5 Jul 31, 2021 · release notes

    Headscale v0.3.5 adds Let's Encrypt listener port config and node deletion subcommands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.5 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.3.5

    └──▷ TRY IT
    Remove a node from the network after interactive confirmation is provided.
    copy

    $ headscale node delete <node-key-or-name>

    • Adds tls_letsencrypt_listen config option to control the port used for TLS-ALPN-01 challenges
    • Adds node delete subcommand with confirmation prompts to remove nodes from the network

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default server port changes to 8080, requiring updates to any configs or firewall rules expecting the previous default.
39. v0.3.0 Jul 11, 2021 · release notes

    Headscale v0.3.0 introduces ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. policy loading and configuration support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.3.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.3.0

    • Added acl path key to the example configuration file for policy definitions
    • Enabled automatic loading of ACL policies during headscale startup

    2 details in Everything

40. v0.1.0 Jun 14, 2021 · release notes

    Headscale v0.1.0: new CLI with SQLite backend, ephemeral nodes, JSON output, and TLS support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.1.0 https://github.com/juanfont/headscale.git
    # already have the repo? check out this version:
    $ git checkout v0.1.0

    • Adds sqlite as a supported database backend via the db_path configuration key
    • Adds the --json flag to CLI commands to output results in JSON format
    • Adds support for ephemeral nodes using pre-auth keys that do not require re-authentication
    • Adds HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. support for the web endpoint with manually configured certificate and key files via config paths
    • Adds support for automatic TLS certificates via Let's Encrypt (autocert)

    +2 more show less

    • Adds new DestroyNamespace CLI subcommand to delete namespaces
    • Adds /etc/headscale and $HOME/.headscale as default locations to search for the config.json file

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The db_path configuration key is now interpreted as relative to the directory where the config file resides if not absolute
    • !The default database backend changed from PostgreSQL (implied by previous versions) to SQLite; previously deployed instances using PostgreSQL will need migration