Nomploy Nomad Packs

← All packs

headscale v0.1.0

Networking

Headscale — an open-source, self-hosted implementation of the Tailscale control server. Run your own coordination server for a WireGuard-based mesh VPN, with no dependency on Tailscale's SaaS. Deployed as a host-networked Nomad service with a rendered config and a SQLite data volume.

nomad-pack run headscale --registry nomploy

Source ↗ Project ↗ ★ 44.1k

1 task http 8080metrics 9099 1 volume image headscale/headscale:0.23.0
Variables 11
values.hcl

Save as values.hcl, edit, then run:

nomad-pack run headscale -f values.hcl --registry nomploy
# The name of the Nomad job.
job_name = "headscale"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The Headscale container image. Pin a tag in production (config schema is version-specific).
image = "headscale/headscale:0.23.0"

# Host port for the Headscale HTTP/control endpoint.
port = 8080

# Host port for the Prometheus metrics endpoint.
metrics_port = 9099

# The public URL clients connect to (SERVER_URL). MUST be reachable by your devices, e.g. http://<node-ip>:8080 or https://vpn.example.com. Empty = http://localhost:<port> (dev only).
server_url = ""

# MagicDNS base domain for the tailnet.
base_domain = "headscale.internal"

# Named volume for the SQLite database and generated keys (/var/lib/headscale).
data_volume = "headscale_data"

# Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# The task resources.
resources = {
    cpu    = 300
    memory = 256
  }
NameTypeDefaultDescription
job_name string 
"headscale"
 The name of the Nomad job.
namespace string 
"default"
 The Nomad namespace to deploy into.
datacenters list 
["*"]
 The datacenters to deploy to.
image string 
"headscale/headscale:0.23.0"
 The Headscale container image. Pin a tag in production (config schema is version-specific).
port number 
8080
 Host port for the Headscale HTTP/control endpoint.
metrics_port number 
9099
 Host port for the Prometheus metrics endpoint.
server_url string 
""
 The public URL clients connect to (SERVER_URL). MUST be reachable by your devices, e.g. http://<node-ip>:8080 or https://vpn.example.com. Empty = http://localhost:<port> (dev only).
base_domain string 
"headscale.internal"
 MagicDNS base domain for the tailnet.
data_volume string 
"headscale_data"
 Named volume for the SQLite database and generated keys (/var/lib/headscale).
constraints list 
[]
 Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources object 
{
    cpu    = 300
    memory = 256
  }
 The task resources.
Readme

headscale

Headscale — an open-source, self-hosted implementation of the Tailscale control server. Run your own coordination server for a WireGuard mesh VPN, independent of Tailscale's SaaS.

Host-networked Nomad service with a rendered config.yaml and a SQLite data volume.

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run headscale --registry=nomploy

Configure

Variable Default Description
port 8080 HTTP/control endpoint.
metrics_port 9099 Prometheus metrics endpoint.
server_url "" Public URL clients connect to — must be reachable by your devices.
base_domain headscale.internal MagicDNS base domain.
data_volume headscale_data /var/lib/headscale — SQLite DB + keys.
image headscale/headscale:0.23.0 Pinned — the config schema is version-specific.
resources { cpu = 300, memory = 256 } Task resources.

Set server_url to a URL your devices can reach (http://<node-ip>:8080 or a TLS domain). The config is pinned to the image version — if you bump image, review config.yaml for schema changes.

Enrol a device

nomad alloc exec -task headscale <alloc> headscale users create myuser
tailscale up --login-server=<server_url> --accept-routes
nomad alloc exec -task headscale <alloc> headscale nodes register --user myuser --key <nodekey>

Pin the job to the node holding the volume with constraints.