OPEN-SOURCE MIGRATION BENCHMARK
License: AGPL-3.0 / BSD-3
★ 24.2k GitHub Stars
Replace Tailscale / Zero-Trust VPN with Self-Hosted Pangolin / Headscale
Self-hosted identity-aware reverse tunnel (Cloudflare Tunnels + Tailscale control server alternative) Stop paying Enterprise / Business ($6–$18/user/mo) ($180/mo for a 10-person team) and run Pangolin / Headscale on a $4.50/mo Linux VPS with full data sovereignty.
10-Seat Annual Savings
+$2,106 / yr
vs Tailscale / Zero-Trust VPN standard plan
Container RAM & vCPU
128 MB RAM
0.25 vCPU • Migration: Easy
Recommended Cloud Box
$4.50/mo VPS
Hetzner CX22 (4GB RAM / 2 vCPU)
1-to-100 Seat Total Cost of Ownership (TCO) Table
Comparing Tailscale / Zero-Trust VPN (Enterprise / Business ($6–$18/user/mo)) vs Pangolin / Headscale on Hetzner CX22 (4GB RAM / 2 vCPU).
| Team Size | Tailscale / Zero-Trust VPN Cost | Pangolin / Headscale VPS | Net Annual Savings |
|---|---|---|---|
| 1 Seat (Solo) | $18.00/mo ($216/yr) | $4.50/mo (CX22) | +$162 / year |
| 5 Seats | $90.00/mo ($1,080/yr) | $4.50/mo (CX22) | +$1,026 / year |
| 10 Seats | $180.00/mo ($2,160/yr) | $4.50/mo (CX22) | +$2,106 / year |
| 25 Seats | $450.00/mo ($5,400/yr) | $4.50/mo (CX22) | +$5,346 / year |
| 50 Seats | $900.00/mo ($10,800/yr) | $4.50/mo (CX22) | +$10,746 / year |
| 100 Seats | $1,800.00/mo ($21,600/yr) | $4.50/mo (CX22) | +$21,546 / year |
Production Docker Compose + Caddy Auto-SSL
Copy and run docker compose up -d on any Ubuntu 24.04 server.
# Production Docker Compose: Pangolin / Headscale (Replaces Tailscale / Zero-Trust VPN)
services:
caddy:
image: caddy:2-alpine
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- ./Caddyfile:/etc/caddy/Caddyfile:ro
- caddy_data:/data
networks:
- stack_net
pangolin:
image: headscale/headscale:latest
container_name: stack-pangolin
restart: unless-stopped
environment:
- "HEADSCALE_SERVER_URL=https://hs.${DOMAIN:-yourdomain.com}"
volumes:
- pangolin_data:/data
networks:
- stack_net
networks:
stack_net:
driver: bridge
volumes:
caddy_data:
pangolin_data:
Caddyfile (Automatic HTTPS Reverse Proxy):
# Automatic Let's Encrypt HTTPS for Pangolin / Headscale
pangolin.{$DOMAIN:yourdomain.com} {
encode zstd gzip
reverse_proxy pangolin:8080
}
Why Teams Switch to Pangolin / Headscale
- ✓Works with official Tailscale iOS/macOS/Windows clients
- ✓100% sovereign coordination server
- ✓Uses <50MB RAM
GitHub Repository
juanfont/headscale
Official Website
github.com/juanfont/headscale
Docker Image
headscale/headscale:latest
Database Needed
Built-in / SQLite
1-Click Cloud VPS Hosting
Deploy Pangolin / Headscale in 60 Seconds
Sized automatically for Pangolin / Headscale (128MB container RAM + OS overhead).
PRODUCTION BOILERPLATE ZIP
Get All 16 Pre-Built Production Stacks + Encrypted S3 Backups
Includes pre-tuned docker-compose.yml, Caddy Auto-SSL, AES-256 encrypted nightly S3/R2 Postgres backups, and Ubuntu 24.04 UFW/Fail2ban hardening scripts.