PrivScale runs your own Headscale control plane so every laptop, server, phone, and sensor you own joins one encrypted mesh — direct connections where possible, relayed where they're not, and no third-party network in between.
Three layers, in the order traffic actually takes: a control plane that introduces devices to each other, an encrypted overlay that carries the traffic, and the endpoints that make up your network.
An open-source, self-hosted implementation of the Tailscale control server. It handles device registration, key exchange, and ACLs — but carries none of your actual traffic.
Once introduced, devices negotiate direct WireGuard tunnels wherever NAT allows, falling back to a relay only when a direct path can't be found.
Workstations, phones, cloud VPS instances, home servers, and single-board devices all register as nodes on the same private address space.
Your network isn't one kind of device. PrivScale doesn't assume it is.
The overlay protocol is the same either way. What changes is who holds the coordination server.
A full playbook for standing up a VPS as an exit node under your own Headscale control plane — fresh-install steps, backup/restore across a rebuild, route approval, and throughput tuning.