Scale
No cap on users or devices
Invite all employees, freelancers, devices, and every server. Open source and self-hosted — no per-seat lock-in, no node limit.
Open source · no per-seat lock-in
Connect laptops, servers, and apps. Invite anyone without counting seats. People join with the clients they already run. You grant, isolate, and revoke from a console you host.
Join a device
Add device prints the join path. No new VPN app to ship, train, or support. Compatible with official Tailscale clients.
No seat math. Isolate who sees what. Reach machines and apps from anywhere.
Scale
Invite all employees, freelancers, devices, and every server. Open source and self-hosted — no per-seat lock-in, no node limit.
Access
Workspaces decide who can access which resource. Tags give granular visibility and control. Give access controls to individual users.
Reach
Join once and reach every allowed machine on the mesh. Publish a local app on a custom subdomain — HTTPS in front, traffic on 100.x.
GHCR images for headscale, core, app, and edge, or one standalone image. Bootstrap mints keys after Headscale is healthy.
Control plane
Vite + Go
Machines, apps, users, workspaces, policies, audit, and keys in one sidebar.
Coordination
Noise + DERP
The protocol server. Local loopback HTTP, or HTTPS when OTTERSCALE_DOMAIN is set.
Publish onto the mesh
Caddy + Go tsnet
TLS in front, reverse-proxy onto 100.x. Network Apps, not Funnel.
One Compose file on a cloud VM. Open source. No per-seat lock-in. Bootstrap mints the keys after Headscale is healthy.