# Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy

DevFeed: [Running a Self-Hosted Tailscale Control Server Behind a Reverse Proxy](<https://devfeed.tech/articles/running-a-self-hosted-tailscale-control-server-behind-a-reverse-proxy-34104.md>)

Original publisher: [Read original article](<https://philipptheserver.com/posts/headscale-behind-traefik-no-h2/>)

Author: Philipp Lehmann (philipp.lehmann@gruppe.ai)

Published: 2026-09-15T07:00:00Z

Content type: tutorial

Language: en

Sources: [Philipp Lehmann](<https://devfeed.tech/sources/philipp-lehmann.md>)

Topics: [tailscale](<https://devfeed.tech/topics/tailscale.md>), [proxy](<https://devfeed.tech/topics/proxy.md>), [traefik](<https://devfeed.tech/topics/traefik.md>), [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [TLS handshake](<https://devfeed.tech/topics/tls-handshake.md>), [Self-hosted](<https://devfeed.tech/topics/self-hosted.md>), [Homelab](<https://devfeed.tech/topics/homelab.md>)

Tags: [dns](<https://devfeed.tech/tags/dns.md>), [docker](<https://devfeed.tech/tags/docker.md>), [h2](<https://devfeed.tech/tags/h2.md>), [homelab](<https://devfeed.tech/tags/homelab.md>), [networking](<https://devfeed.tech/tags/networking.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [reverse-proxy](<https://devfeed.tech/tags/reverse-proxy.md>), [security](<https://devfeed.tech/tags/security.md>), [self-hosted](<https://devfeed.tech/tags/self-hosted.md>), [tailscale](<https://devfeed.tech/tags/tailscale.md>), [tls](<https://devfeed.tech/tags/tls.md>), [tls-handshake](<https://devfeed.tech/tags/tls-handshake.md>), [traefik](<https://devfeed.tech/tags/traefik.md>)

## AI overview

This tutorial explains how to run a self-hosted Tailscale control server, Headscale, behind Traefik. It finds that the reverse proxy must use TLS with HTTP/1.1 only because Tailscale's noise handshake expects a full-duplex byte stream and can fail when ALPN negotiates HTTP/2.

## Source excerpt

Headscale behind Traefik: tls.options=no-h2@file with alpnProtocols http/1.1, because the Tailscale noise handshake breaks when ALPN negotiates h2.