Headscale Policy Editor

A simple Headscale policy editor built with Monaco Editor, deployed as a tsnet service

Features

• tsnet integration – Runs as a Tailscale-connected service with policy-enforced access control
• JSON Schema validation – Typed policy to accelerate writing and help catch potential errors
• Headscale Unix socket support – Connects directly to Headscale without requiring API keys

Deploy

Docker

Note

Make sure the headscale-socket volume exists and is mounted to Headscale’s /var/run/headscale directory.

docker run -it -v headscale-socket:/var/run/headscale:ro -v headscale-policy-editor-data:/data:rw ghcr.io/rickli-cloud/headscale-policy-editor:unstable serve --control-url https://headscale.example.com

Image Tags

• latest: Latest stable release
• x.x.x: Specific release versions
• x.x.x-pre: Pre-release versions (potentially unstable)
• unstable: Built on every push to the main branch