PrivScale runs your own Headscale control plane so every laptop, server, phone, and sensor you own joins one encrypted mesh — direct connections where possible, relayed where they're not, and no third-party network in between.
Three layers, in the order traffic actually takes: a control plane that introduces devices to each other, an encrypted overlay that carries the traffic, and the endpoints that make up your network.
An open-source, self-hosted implementation of the Tailscale control server. It handles device registration, key exchange, and ACLs — but carries none of your actual traffic.
Once introduced, devices negotiate direct WireGuard tunnels wherever NAT allows, falling back to a relay only when a direct path can't be found.
Workstations, phones, cloud VPS instances, home servers, and single-board devices all register as nodes on the same private address space.
Your network isn't one kind of device. PrivScale doesn't assume it is.
The overlay protocol is the same either way. What changes is who holds the coordination server.
Two playbooks covering both sides of a self-hosted mesh: standing up the control plane, and joining a VPS to it as an exit node.
Stand up your own Headscale control plane on a single VPS — Docker Compose, Traefik, and Let's Encrypt, with Headscale-UI for day-to-day admin and an optional tailnet-only lockdown of the web UI.
Join a VPS to an existing Headscale server as an exit node — fresh-install steps, backup/restore across a rebuild, route approval, and throughput tuning.