Security
Headscale
High risk: the service gets the right to bind ports 80 and 443 (CAP_NET_BIND_SERVICE) and uses them for its own Let's Encrypt certificate. Downloads the official Headscale release, checks its SHA-256, installs it in /usr/local/bin, writes /etc/headscale/config.yaml, runs it as a hardened systemd service (dynamic user, data in /var/lib/headscale) and creates the first user. Setup creates the domain's DNS record when it can; otherwise point it at this server yourself.
What it does
Security Tool Installers
What you will be asked
You fill these in during setup.
- Domain name RequiredThe domain of your Headscale server, for example hs.example.com. Its DNS A record must point to this server: Setup creates it in your DNS when it can, otherwise add it yourself; devices and the Let's Encrypt certificate need it. It cannot be changed later without re-registering the devices.
- Email for certificate notices OptionalOptional. Let's Encrypt uses it to warn you about certificate problems.
- First user name RequiredAdvanced settingsThe Headscale user that owns your first devices (lowercase letters, digits and dashes). More users can be added later with the headscale command.
- Private DNS suffix RequiredAdvanced settingsThe suffix devices get inside the tailnet (device.suffix). It must not be your server domain or a part of it. The default tailnet.internal is fine for most people.