Headscale is an open-source, self-hosted implementation of the Tailscale control plane. It provides a complete VPN solution including user management, node registration, policy enforcement (ACLs, SSH rules, route approvals), API services (v1 and v2), DERP relay capabilities, MagicDNS, and OAuth/OIDC integration. The architecture follows a modular monolith pattern with clear separation between CLI, API, core application logic, state management, policy engine, database layer, and network mapping components. Key entry points include the main CLI command (cmd/headscale/headscale.go) and various subcommands for administration, along with HTTP API handlers for client and management interactions. The system manages the complete lifecycle of a tailnet: authenticating devices, assigning WireGuard keys and IP addresses, enforcing access policies, and distributing network map updates to connected clients.