headscale-derp

To deploy a DERP relay server for Headscale, use the deployment script to provision a standalone relay node with Docker, specifying your region ID and hostname. This containerized deployment includes integrated TLS and STUN configuration for encrypted traffic relay.

A DERP relay is an encrypted traffic relay server used when direct peer-to-peer connections in Tailscale or Headscale networks are unavailable. You need it when NAT traversal fails, ensuring your tailnet maintains connectivity through a reliable fallback relay mechanism.

Yes, you can perform comprehensive connectivity diagnostics on DERP relay servers, including STUN, TLS, and WebSocket endpoint verification. These health checks ensure relay availability and help identify issues across your Tailscale or Headscale environment.

Yes, Docker is required for containerized deployment of standalone DERP relay nodes. The automated deployment process uses Docker to provision relay servers with integrated TLS and STUN configuration, alongside standard network utilities for connectivity verification.

You can measure and rank DERP region performance using built-in latency analysis features. This measures relay response times across different geographic regions to optimize network routing for your distributed Tailscale or Headscale tailnet.

Tailscale traffic falls back to DERP relay mode when direct peer-to-peer NAT traversal fails to establish a connection. The relay mechanism ensures traffic remains encrypted while providing a reliable fallback path for environments where direct connectivity is blocked.