Headscale is a Go-based server that reimplements the proprietary Tailscale control plane. It acts as a coordination server: exchanging WireGuard public keys between nodes, assigning IP addresses in the 100.64.0.0/10 (and IPv6 ULA) range, managing DERP relays, enforcing ACL policies, and orchestrating NAT traversal for a private overlay network (a 'tailnet').

The problem it solves: Tailscale clients are open source, but the control server is not. Users who want the Tailscale UX (zero-config mesh VPN, MagicDNS, subnet routing, node sharing) without depending on Tailscale Inc.'s hosted service need a compatible drop-in server. Headscale provides exactly that, scoped intentionally to a single tailnet suitable for individuals, homelabs, and small organizations.

Users are primarily self-hosters, hobbyists, and small teams. They run the `headscale` binary (server) alongside standard Tailscale clients on their devices. Administration is done via a CLI (`cmd/headscale`) that talks to the server over a Unix socket or gRPC, plus a REST API (v1/v2 defined via Huma with OpenAPI specs). Configuration is YAML-based; storage is SQLite or PostgreSQL via GORM.

Architecturally, the `hscontrol` package is the core: it implements the Tailscale noise protocol, map/poll endpoints, DERP server integration, OIDC authentication, policy engine (HuJSON ACLs), and a state machine for node registration and updates. The `integration/` tree uses Docker (via ory/dockertest) to spin up real Tailscale clients against Headscale for end-to-end testing. Helper commands include `cmd/hi` (integration test runner), `cmd/dev` (local dev server), and `cmd/gen-openapi` (spec generation).

The project is mature and well-maintained: golangci-lint, gofumpt, pre-commit hooks, Nix flake for reproducible dev environments, extensive CI (build, integration tests, container images, docs deploy), gormigrate for schema migrations, and explicit documentation about a fragile modernc/sqlite dependency chain. One maintainer is disclosed as a Tailscale employee contributing on work time, with review by independent maintainers.