Can Headscale be proxies behind cloudflare?
reddit / selfhosted

----------------------------------------------------------------------
alex0708 · 2023-10-25 21:49

Like the title says. In my current setup I have a headscale server
hosted in my DMZ. I use DDNS via cloudflare and have a dns-only A
record pointed at my headscale server.

This setup is working at the moment, but I don’t love that it exposes
my home network’s IP address via the A record. Is it possible to get
headscale working while proxying through cloudflare? So far I haven’t
been able to get clients to connect to the coordination server while
proxying is enabled.

----------------------------------------------------------------------
NikStalwart · 2023-10-26 02:28

This is a case of RTFM. Specifically,
[TFM](https://github.com/juanfont/headscale#running-headscale) says:

> Please note that we do not support nor encourage the use of reverse
proxies and container to run Headscale.

Notwithstanding the above, there is [community
documentation](https://headscale.net/reverse-proxy/#nginx) to run
headscale behind conventional reverse proxies.

However, per the headscale discord, cloudflare does not work because
tailscale/headscale utilize a non-standard websocket negotiation.

If you want an alternative to headscale without publicly exposing your
home IP *too much*, I highly recommend trying something like
[innernet](https://github.com/tonarino/innernet).

What I like about innernet is that the control interface is *only*
exposed within the VPN network, so there is no big deal that your IP
is internet-facing — all non-WG connections to the open WG port are
dropped, and WG connections require authentication.

----------------------------------------------------------------------
watchdog_timer · 2023-10-26 13:11

You could turn off your Headscale tunnel and replace it with a
Cloudflare tunnel. That would provide the same functionality without
exposing your IP address.