官方链接：Official releases - Headscale
1、下载headscale
HEADSCALE_VERSION=$(curl -s "https://api.github.com/repos/juanfont/headscale/releases/latest" | grep '"tag_name"' | sed -E 's/.*"([^\"]+)".*/\1/' | sed 's/v//')
HEADSCALE_ARCH="amd64" # 根据架构调整
lovejjt 的个人博客
wget --output-document=headscale.deb \
"https://下载地址/headscale_${HEADSCALE_VERSION}_linux_${HEADSCALE_ARCH}.deb"
https://github.com/juanfont/headscale/releases/download/v0.28.0/headscale_0.28.0_linux_amd64.deb
sudo apt install ./headscale.deb
sudo nano /etc/headscale/config.yaml
sudo systemctl enable --now headscale
sudo systemctl status headscale
推荐使用deb包安装方式，它能自动处理用户权限和服务管理等复杂问题。二进制安装方式则适合需要高度自定义环境的高级用户。安装完成后，建议参考官方文档进行进一步的配置和使用。
只要满足以下要求，Headscale 就应该工作：
如果部分端口已被占用，需要调整配置文件，修改部分端口。
以下是github官方的更新说明：
Minimum supported Tailscale client version: v1.74.0
Tags are now implemented following the Tailscale model where tags and user ownership are mutually exclusive. Devices can be either
user-owned (authenticated via web/OIDC) or tagged (authenticated via tagged PreAuthKeys). Tagged devices receive their identity from
tags rather than users, making them suitable for servers and infrastructure. Applying a tag to a device removes user-based
ownership. See the Tailscale tags documentation for details on how tags work.
User-owned nodes can now request tags during registration using --advertise-tags. Tags are validated against the tagOwners policy
and applied at registration time. Tags can be managed via the CLI or API after registration. Tagged nodes can return to user-owned
by re-authenticating with tailscale up --advertise-tags= --force-reauth.
A one-time migration will validate and migrate any RequestTags (stored in hostinfo) to the tags column. Tags are validated against
your policy's tagOwners rules during migration. #3011
The map update system has been rewritten to send smaller, partial updates instead of full network maps whenever possible. This reduces bandwidth usage and improves performance, especially for large networks. The system now properly tracks peer
changes and can send removal notifications when nodes are removed due to policy changes.
#2856 #2961
Pre-authentication keys now use bcrypt hashing for improved security #2853. Keys
are stored as a prefix and bcrypt hash instead of plaintext. The full key is only displayed once at creation time. When listing keys,
only the prefix is shown (e.g., hskey-auth-{prefix}-***). All new keys use the format hskey-auth-{prefix}-{secret}. Legacy plaintext keys in the format {secret} will continue to work for backwards compatibility.
The OIDC callback and device registration web pages have been updated to use the Material for MkDocs design system from the official
documentation. The templates now use consistent typography, spacing, and colours across all registration flows.
Headscale no longer supports direct upgrades from databases created before version 0.25.0. Users on older versions must upgrade
sequentially through each stable release, selecting the latest patch version available for each minor release.
API: The Node message in the gRPC/REST API has been simplified - the ForcedTags, InvalidTags, and ValidTags fields have been removed and replaced with a single Tags field that contains the node's applied tags #2993
Tags field instead of ValidTagsheadscale nodes list CLI command now always shows a Tags column and the --tags flag has been removedPreAuthKey CLI: Commands now use ID-based operations instead of user+key combinations #2992
headscale preauthkeys create no longer requires --user flag (optional for tracking creation)headscale preauthkeys list lists all keys (no longer filtered by user)headscale preauthkeys expire --id <ID> replaces --user <USER> <KEY>headscale preauthkeys delete --id <ID> replaces --user <USER> <KEY>Before:
headscale preauthkeys create --user 1 --reusable --tags tag:server
headscale preauthkeys list --user 1
headscale preauthkeys expire --user 1 <KEY>
headscale preauthkeys delete --user 1 <KEY>
After:
headscale preauthkeys create --reusable --tags tag:server
headscale preauthkeys list
headscale preauthkeys expire --id 123
headscale preauthkeys delete --id 123
Tags: The gRPC SetTags endpoint now allows converting user-owned nodes to tagged nodes by setting tags. #2885
Tags: Tags are now resolved from the node's stored Tags field only #2931
--advertise-tags is processed during registration, not on every policy evaluation--advertise-tags from clients--advertise-tags if authorized by tagOwners policyheadscale nodes tag) or the SetTags API after registrationDatabase migration support removed for pre-0.25.0 databases #2883
Remove ability to move nodes between users #2922
headscale nodes move CLI command has been removedMoveNode API endpoint has been removedAdd oidc.email_verified_required config option to control email verification requirement #2860
true (default), only verified emails can authenticate via OIDC in conjunction with oidc.allowed_domains oroidc.allowed_users. Previous versions allowed to authenticate with an unverified email but did not store the emailunverified email error.false, unverified emails are allowed for OIDC authentication and the email address is stored in the userSSH Policy: Wildcard (*) is no longer supported as an SSH destination #3009
autogroup:member for user-owned devicesautogroup:tagged for tagged devicestag:server) for targeted accessBefore:
{ "action": "accept", "src": ["group:admins"], "dst": ["*"], "users": ["root"] }
After:
{ "action": "accept", "src": ["group:admins"], "dst": ["autogroup:member", "autogroup:tagged"], "users": ["root"] }
SSH Policy: SSH source/destination validation now enforces Tailscale's security model #3010
Per Tailscale SSH documentation, the following rules are now enforced:
tag:* or autogroup:tagged as source cannot have username destinations (e.g., alice@) or autogroup:member/autogroup:self as destinationalice@), the source must be that exact same user only. Use autogroup:self for same-user SSH access insteadInvalid policies now rejected at load time:
// INVALID: tag source to user destination
{"src": ["tag:server"], "dst": ["alice@"], ...}
// INVALID: autogroup:tagged to autogroup:member
{"src": ["autogroup:tagged"], "dst": ["autogroup:member"], ...}
// INVALID: group to specific user (use autogroup:self instead)
{"src": ["group:admins"], "dst": ["alice@"], ...}
Valid patterns:
// Users/groups can SSH to their own devices via autogroup:self
{"src": ["group:admins"], "dst": ["autogroup:self"], ...}
// Users/groups can SSH to tagged devices
{"src": ["group:admins"], "dst": ["autogroup:tagged"], ...}
// Tagged devices can SSH to other tagged devices
{"src": ["autogroup:tagged"], "dst": ["autogroup:tagged"], ...}
// Same user can SSH to their own devices
{"src": ["alice@"], "dst": ["alice@"], ...}
官方文档翻译：
只要满足以下要求，headscale应该就能正常工作：
所使用的端口会根据预期场景和启用的功能而有所不同。部分列出的端口可以通过配置文件更改，但我们建议使用默认设置。
headscale等级文档和提供的示例是在考虑以下几个假设的情况下编写的：
headscale/etc/headscale/config.yaml加载 。/var/lib/headscale 。<VALUE_TO_CHANGE>``headscale.example.com请根据当地环境进行调整。
官方说明-开始使用：
本页面帮助你开始使用 headscale，并提供了 headscale 命令行工具的一些使用示例。headscale
前提条件
命令行工具内置了帮助。要显示可用命令及其参数和选项，请执行：headscale
# Show help
headscale help
# Show help for a specific command
headscale <COMMAND> --help
管理来自其他本地用户的headscale
默认情况下，只有用户或 会拥有访问用于与服务通信的 unix 套接字（）的必要权限。为了能与 headscale 服务通信，你必须确保执行命令的用户能访问 Unix 套接字。一般来说，你可以通过以下任一方法实现：headscale``root``/var/run/headscale/headscale.sock
sudoheadscaleheadscale为了验证，您可以使用您偏好的方法执行以下命令：
headscale users list
在headscale中，节点（机器或设备）通常分配给headscale用户。这样的headscale用户可能分配了许多节点，并可通过该命令进行管理。点击内置帮助以获取更多信息： 。headscale users``headscale users --help
headscale users create <USER>
headscale users list
必须先注册节点，才能将 headscale 作为 Tailscale 的协调服务器。以下示例适用于Linux/BSD操作系统上的Tailscale客户端。或者，按照说明连接安卓、苹果或Windows设备。请阅读注册方法，了解可用的注册方法概览。
在客户端机器上，执行命令并以你的 headscale 实例的 FQDN 作为参数提供：tailscale up
tailscale up --login-server <YOUR_HEADSCALE_URL>
通常会打开一个带有进一步说明的浏览器窗口。本页解释了如何在您的headscale服务器上完成注册，并打印了批准节点所需的注册密钥：
headscale nodes register --user <USER> --key <REGISTRATION_KEY>
也可以生成预授权密钥并非交互式注册节点。首先，在 headscale 实例上生成预授权密钥。默认情况下，钥匙有效期为一小时，且只能使用一次（参见其他选项）：headscale preauthkeys --help
headscale preauthkeys create --user <USER_ID>
该命令在成功时返回预授权密钥，用于通过以下命令将节点连接到headscale实例：tailscale up
tailscale up --login-server <YOUR_HEADSCALE_URL> --authkey <YOUR_AUTH_KEY>
本文档旨在展示用户如何使用带有headscale的官方Android Tailscale客户端。
从Google Play商店或F-Droid安装官方的Tailscale Android客户端。
AccountsUse an alternate serverhttps://headscale.example.comAccountsUse an alternate serverhttps://headscale.example.comAccountsUse an auth keyLog in本文档旨在展示用户如何使用带有 headscale 的官方 Windows Tailscale 客户端。
关于你的Headscale实例的说明
在你的运行实例上，也有一个端点，提供如何连接你的Windows设备的信息。/windows
下载官方Windows客户端并安装。
打开命令提示符或 Powershell，使用 Tailscale 的登录命令连接到你的 headscale 实例（例如）：https://headscale.example.com
tailscale login --login-server <YOUR_HEADSCALE_URL>
按照打开的浏览器窗口中的指示完成配置。
默认情况下，Tailscale的Windows客户端仅在用户登录时运行。如果你想让 Tailscale 一直运行，请启用“无人值守模式”：
PreferencesRun unattended如果你看到以下信息反复出现：
[GIN] 2022/02/10 - 16:39:34 | 200 | 1.105306ms | 127.0.0.1 | POST "/machine/redacted"
在你的headscale输出中，打开日志，寻找：DEBUG
2022-02-11T00:59:29Z DBG Machine registration has expired. Sending a authurl to register machine=redacted
这通常意味着上述注册表键未被正确设置。
要重置并重新尝试，重要的是：
C:\Users\<USERNAME>\AppData\Local\Tailscale