{"full_name":"juanfont/headscale","owner":"juanfont","name":"headscale","url":"https://github.com/juanfont/headscale","description":"An open source, self-hosted implementation of the Tailscale control server","homepage":"","topics":[],"language":"Go","license":"BSD-3-Clause","avatar":"https://avatars.githubusercontent.com/u/181059?u=56e87e3bf1145a99035e3ef576bc8c099214ac70&v=4","created_at":"2020-06-21T09:21:05Z","pushed_at":"2026-11-10T04:49:57Z","metrics":{"stars":45542,"forks":2633,"watchers":212,"issues":1393,"prs":2264,"releases":144,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":0},"growth":{"day":{"stars":42,"forks":-2,"base_day":"2026-11-09"}},"history":{"dates":["2026-11-09","2026-11-10"],"stars":[45500,45542],"forks":[2635,2633],"watchers":[212,212],"issues_open":[null,null],"prs_open":[null,null]},"boards":{},"same_owner":[],"issues":[{"number":234,"title":"Any WEB UI planned?","comments":57,"created_at":"2021-11-23T11:49:56Z"},{"number":1545,"title":"Support for WireGuard only peers","comments":51,"created_at":"2023-09-07T18:03:03Z"},{"number":2695,"title":"[Feature] multiple replicas of headscale instances","comments":24,"created_at":"2025-07-18T15:49:53Z"},{"number":1307,"title":"Tailnet Lock Feature request","comments":22,"created_at":"2023-04-02T04:35:29Z"},{"number":1531,"title":"Enhance OIDC Authentication with refresh_token Support","comments":19,"created_at":"2023-08-21T18:49:16Z"},{"number":2366,"title":"[Feature] Support using groups from OIDC in ACLs","comments":18,"created_at":"2025-01-22T13:50:06Z"},{"number":1651,"title":"FR: support for App Connectors","comments":17,"created_at":"2023-12-13T16:56:51Z"},{"number":3119,"title":"[Bug] Running headscale command-line outputs very slowly","comments":16,"created_at":"2026-03-01T08:16:27Z"}],"discussions":[],"latest_release":{"name":"v0.29.7","tag":"v0.29.7","published_at":"2026-10-30T09:55:40Z","body":"**Minimum supported Tailscale client version: v1.80.0**\r\n\r\n### Security\r\n\r\nThis is a security release. It fixes findings from Anthropic's oss-scanner project and\r\nthe Tailworm report. None are critical, but some can cause denial of service in\r\nHeadscale. We recommend that all users upgrade to Headscale 0.29.7 **and** Tailscale\r\nv1.104.4 or newer as soon as possible, especially those using Tailscale SSH.\r\n\r\nTailscale v1.104.4 fixes vulnerabilities in SSH forwarding, SSH session handling and\r\nServe. These fixes run in `tailscaled` on your nodes; upgrading Headscale alone does\r\nnot apply them.\r\n\r\nSee Tailscale's [security bulletins](https://tailscale.com/security-bulletins#ts-2026-014) and [Tailscale SSH: Findings and fixes](https://tailscale.com/blog/tailscale-ssh-findings-fixes).\r\n\r\nTo disable SSH agent and port forwarding on a node, set\r\n`TS_SSH_DISABLE_FORWARDING=1` in the `tailscaled` service environment and restart\r\nthe service. This setting applies to all Tailscale SSH sessions on that node and\r\nis also available in older clients. [#3624](https://github.com/juanfont/headscale/pull/3624)\r\n\r\nThis release also fixes the issues that [oss-scanner](https://github.com/anthropics/oss-scanner/tree/main/projects/headscale)\r\nreported in Headscale: ANT-2026-MLP8ZR5T, ANT-2026-LYVGXVSW, ANT-2026-AWGRB7O1, ANT-2026-QMCAFJ1Q, ANT-2026-RQS7JAPP, ANT-2026-5B6KE87K, ANT-2026-KFCFFM34, ANT-2026-K903ZEUA, ANT-2026-NM50ZP4N, ANT-2026-ZC18AF82, ANT-2026-NWTIBB02, ANT-2026-MX8FKG4K. [#3603](https://github.com/juanfont/headscale/pull/3603)\r\n\r\n### Changes\r\n\r\n- Metrics are no longer exposed to unregistered clients through the Noise protocol. They remain available only on the configured metrics listener; an empty `metrics_listen_addr` disables that listener [#3623](https://github.com/juanfont/headscale/pull/3623)\r\n- Update the Tailscale dependency to v1.104.4, which bounds how much of an unexpected DERP HTTP response is read [#3577](https://github.com/juanfont/headscale/pull/3577)\r\n- Keep pending registrations and OIDC logins at capacity instead of evicting ones awaiting approval; new requests get a retry response, and registered nodes keep capacity for SSH checks [#3586](https://github.com/juanfont/headscale/pull/3586)\r\n- Cap stored pending registration data at 64 KiB, keeping tags and expiry; oversized interactive registrations are rejected [#3586](https://github.com/juanfont/headscale/pull/3586)\r\n- Check the OIDC login type before storing anything, accept each OIDC callback only once, and free an SSH check's slot once the client has read its result [#3586](https://github.com/juanfont/headscale/pull/3586)\r\n- Stop serving a route that is a single address inside the node IP ranges, such as `100.64.0.11/32` or `::ffff:100.64.0.11/128`, because it names a node, not a subnet; the route stays approved and listed, and wider routes are still served [#3603](https://github.com/juanfont/headscale/pull/3603)\r\n- Require a valid pre-auth key to re-register an expired tagged node [#3603](https://github.com/juanfont/headscale/pull/3603)\r\n- Another user's key or login on a tagged machine now creates a new device for that user instead of re-authenticating the tagged node [#3603](https://github.com/juanfont/headscale/pull/3603)\r\n- Fix one node with a stored key expiry outside the years 0 to 9999 in UTC failing the map of every node that can see it; it is now left out of its peers' maps and the startup check names it with the fix command [#3603](https://github.com/juanfont/headscale/pull/3603)\r\n- Refuse a key expiry outside the years 0 to 9999 in UTC on registration, on the OIDC token-expiry path and in `headscale nodes expire` / `POST /api/v1/node/{node_id}/expire` (HTTP 400); the latest accepted expiry no longer fails node listings on PostgreSQL in a zone east of UTC [#3603](https://github.com/juanfont/headscale/pull/3603)\r\n- Keep the first 256 endpoints and 4096 announced routes from client reports; oversized hostnames, requested tags or other metadata return a re"},"readme":true,"readme_zh":false,"news":[],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}