juanfont/headscale

Headscale is an open-source, self-hosted implementation of the Tailscale control plane, managing network topology, authentication, and access policies. It provides a comprehensive API (v1/v2) and CLI for administering users, devices, and keys, while enforcing strict security through OAuth2 and scope-based access control. The system also handles dynamic DNS, route auto-approval, and DERP map management to facilitate secure peer-to-peer connectivity.

This period focused on implementing secure API key and OAuth2 authentication flows, including database support, type definitions, and CLI commands. The work also established a robust integration testing framework using Docker containers and standardized test utilities, while fixing policy matching and refactoring the DERP map loading logic.

17 changes

This period focused on overhauling the policy engine with a new v2 implementation and automatic route approval, while simultaneously modernizing the web interface and build infrastructure. Significant improvements were made to node state management, SQLite configuration, and integration testing, alongside the introduction of NixOS packaging support.

15 changes

This period focused on implementing the v2 API and policy engine, introducing a Huma-based code-first API with OAuth scope enforcement and Tailscale-compatible endpoints. Significant effort was also dedicated to the policy v2 compatibility tests, adding extensive test data for ACLs, routing, SSH, and node attributes to ensure correct behavior.

17 changes

juanfont/headscale was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point the surveyor at a repository you know and see whether you agree with it.