Self-hosted control planes for mesh networking are a small population by design. Headscale is an open-source implementation of a coordination server for clients that would otherwise use a hosted service, and its numbers online are worth reading precisely because they are small. A tiny count is where measurement discipline earns its keep.

The counts

ZoomEye queries on 23 October 2026, sub_type=all, page size one:

  • title="Headscale": 85

  • title="Headscale" && port="443": 18

  • title="Headscale" && ssl="headscale": 7
    These are the smallest figures in this series, and they do not imply the software is barely used. That conclusion would not follow from the data.

Why the number is small for a good reason

A coordination server is infrastructure for a private network. Its users are the devices enrolled in that network, and they reach it over the mesh, which means the server can sit behind the same overlay it coordinates or on a private address reachable only through an initial bootstrap path.
Organisations that self-host such a service usually do so for exactly that reason: they want the control plane off the public internet. The architecture pushes toward the same outcome that security review would recommend.
The second reason is presentation. A control plane is rarely intended for a browser, so the responses it produces are protocol messages, not HTML pages with titles. Where a UI exists, it may be a separate component or a plain API response.

What a small count can still tell you

Eighty-five assets present a title naming the product. Eighteen of those are on 443, and seven present a certificate that mentions the name. Each figure is a different kind of evidence, and their overlap is unknown.
For an organisation running the service, the useful interpretation is narrower than the count: does anything on the public internet confirm that this infrastructure exists. A certificate naming the product, published by the same organisation, connects the identifier to a network block. That is the kind of link that a targeted attacker uses to decide where to spend effort.

The security model of a coordination server

The server distributes network configuration and node keys. It does not carry user traffic in normal operation; the peers connect directly or through relays. That separation is good design and it concentrates risk in one place.
Compromise of the coordination server means control over the network map. An attacker who can register a node and obtain configuration can place themselves inside the mesh, subject to the policy the server distributes. The server therefore holds the authority that a VPN concentrator holds, without the data path that would otherwise be visible in traffic monitoring.
The credentials are accordingly high value: the server's own database of nodes, any pre-authentication keys issued for enrolment, and the API tokens used to administer it.

Practical checks

  • Confirm whether the coordination server needs a public listener at all. Many deployments require one for initial enrolment or for roaming clients, and that requirement is worth stating explicitly rather than inherited.

  • Restrict the enrolment path. A pre-authentication key is a durable credential; its lifetime and its distribution decide how much a leak matters.

  • Review certificates. A name that identifies the software is unnecessary for a private service and provides free confirmation to anyone who looks.

  • Separate administration from coordination. Where the server's API and its node-facing endpoints share a listener, a single network path exposes both.

  • Back up the node database. Rebuilding a mesh from lost state means re-enrolling every device, which is an operational event as much as a security one.

Detection notes

Node registration is the event with the most signal. Each registration has a key, a timestamp and a source address. A registration from an unfamiliar address, or one that uses a key that should have expired, is unambiguous.
API access to the server forms the second record. Administrative calls are rare in a stable deployment, which makes any anomaly visible against a quiet baseline.

Reading small numbers, again

A count of seven certificates is not a finding; it is seven opportunities to confirm an organisation's infrastructure by inspection. The lesson generalises to every small, self-hosted control plane: the population is small, the individual exposure is concentrated, and the value of the measurement comes from interpreting each query as a separate instrument rather than averaging them into a single belief about how many systems exist.

References

  • Headscale documentation: https://headscale.net/

  • Headscale source repository: https://github.com/juanfont/headscale

  • ZoomEye queries executed 23 October 2026 with sub_type=all: title="Headscale" 85; title="Headscale" && port="443" 18; title="Headscale" && ssl="headscale" 7