diff --git a/.gitignore b/.gitignore
index 63c171b..c07bb84 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,12 +2,7 @@
 sync.ffs_lock
 .sync.ffs_db
 
-# Environment 
-.env
-.env.anna
-.env.forust
-.env.*
-!.env.*example
+
 
 # Volumes and data directories
 gitea/gitea-db/
@@ -23,6 +18,8 @@ termix/termix-data/*
 cfddns/config.json
 checkmk/checkmk/*
 downtify/Downtify_downloads
+headscale/config/*
+headscale/data/*
 
 # Steaming services files
 streaming/jellyfin/*
@@ -86,3 +83,10 @@ replacements.txt
 # Temp files
 edu_master/temp/
 temp/*
+
+# Environment 
+.env
+.env.anna
+.env.forust
+.env.*
+!*example
diff --git a/adguardhome/compose.yaml b/adguardhome/compose.yaml
index e2d40f6..503a82d 100644
--- a/adguardhome/compose.yaml
+++ b/adguardhome/compose.yaml
@@ -9,7 +9,7 @@ services:
       - "853:853/tcp" # DNS over TLS
       # - "67:67/udp" # DHCP
       # - "68:68/tcp" # DHCP
-      - "3000:3000/tcp"
+      # - "3000:3000/tcp"
     volumes:
       - ./data/work:/opt/adguardhome/work
       - ./data/conf:/opt/adguardhome/conf
diff --git a/authentik/compose.yaml b/authentik/compose.yaml
index 2311c1c..4acee8e 100644
--- a/authentik/compose.yaml
+++ b/authentik/compose.yaml
@@ -26,9 +26,9 @@ services:
     command: server
     container_name: authentik-server
     restart: unless-stopped
-    ports:
-      - ${PORT_HTTP:-9000}:9000
-      - ${PORT_HTTPS:-9443}:9443
+    # ports:
+    #   - ${PORT_HTTP:-9000}:9000
+    #   - ${PORT_HTTPS:-9443}:9443
     env_file:
       - .env
     environment:
diff --git a/headscale/compose.yaml b/headscale/compose.yaml
new file mode 100644
index 0000000..9d07753
--- /dev/null
+++ b/headscale/compose.yaml
@@ -0,0 +1,81 @@
+services:
+  server:
+    image: headscale/headscale:latest
+    restart: unless-stopped
+    command: serve
+    networks:
+      - proxy
+    volumes:
+      - ./config:/etc/headscale
+      - ./data:/var/lib/headscale
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+      - "traefik.http.services.headscale.loadbalancer.server.port=8080"
+      - "traefik.http.services.headscale-metrics.loadbalancer.server.port=9090"
+
+      ## SERVICE
+      # Prod Router
+      - "traefik.http.routers.headscale.rule=Host(`hs.forust.xyz`)"
+      - "traefik.http.routers.headscale.entrypoints=websecure"
+      - "traefik.http.routers.headscale.service=headscale"
+      - "traefik.http.routers.headscale.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-local.rule=Host(`hs.workstation.internal`)"
+      - "traefik.http.routers.headscale-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-local.service=headscale"
+      - "traefik.http.routers.headscale-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-dev.rule=Host(`hs.gigaforust.internal`)"
+      - "traefik.http.routers.headscale-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-dev.service=headscale"
+      - "traefik.http.routers.headscale-dev.tls=true"
+
+      ## METRICS
+      # Prod Router
+      - "traefik.http.routers.headscale-metrics.rule=Host(`hs.forust.xyz`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-metrics-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-local.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-metrics-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/metrics`)"
+      - "traefik.http.routers.headscale-metrics-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-metrics-dev.service=headscale-metrics"
+      - "traefik.http.routers.headscale-metrics-dev.tls=true"
+  web:
+    image: goodieshq/headscale-admin:latest
+    restart: unless-stopped
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "treafik.docker.network=proxy"
+      - "traefik.http.services.headscale-ui.loadbalancer.server.port=80"
+      
+      # Prod Router
+      - "traefik.http.routers.headscale-ui.rule=Host(`hs.forust.xyz`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui.tls=true"
+      # Local Router
+      - "traefik.http.routers.headscale-ui-local.rule=Host(`hs.workstation.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-local.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-local.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-local.tls=true"
+      # Dev Router
+      - "traefik.http.routers.headscale-ui-dev.rule=Host(`hs.gigaforust.internal`) && PathPrefix(`/admin`)"
+      - "traefik.http.routers.headscale-ui-dev.entrypoints=websecure"
+      - "traefik.http.routers.headscale-ui.middlewares=security-chain@file"
+      - "traefik.http.routers.headscale-ui-dev.service=headscale-ui"
+      - "traefik.http.routers.headscale-ui-dev.tls=true"
+
+networks:
+  proxy:
+    external: true
diff --git a/headscale/config/config.yaml.example b/headscale/config/config.yaml.example
new file mode 100644
index 0000000..1a485bf
--- /dev/null
+++ b/headscale/config/config.yaml.example
@@ -0,0 +1,79 @@
+# https://wiki.serversatho.me/en/headscale
+
+# # Prod server_url
+# server_url: https://hs.example.com
+# # Local server_url
+# server_url: https://hs.internal_domain.internal
+# # Dev server_url
+# server_url: https://hs.dev_internal_domain.internal
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 127.0.0.1:50443
+grpc_allow_insecure: false
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+derp:
+  server:
+    enabled: true
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    ipv4: 1.2.3.4
+    ipv6: 2001:db8::1
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 24h
+disable_check_updates: false
+ephemeral_node_inactivity_timeout: 30m
+database:
+  type: sqlite
+  debug: false
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+tls_letsencrypt_challenge_type: HTTP-01
+tls_letsencrypt_listen: ":http"
+tls_cert_path: ""
+tls_key_path: ""
+log:
+  format: text
+  level: info
+policy:
+  mode: database
+  path: ""
+dns:
+  magic_dns: true
+  base_domain: example.com
+  nameservers:
+    global:
+      - 1.1.1.1
+      - 1.0.0.1
+      - 2606:4700:4700::1111
+      - 2606:4700:4700::1001
+    split: {}
+  search_domains: []
+  extra_records: []
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+logtail:
+  enabled: false
+randomize_client_port: false
diff --git a/homepages/compose.yaml b/homepages/compose.yaml
index eeabd28..17c3fac 100644
--- a/homepages/compose.yaml
+++ b/homepages/compose.yaml
@@ -3,8 +3,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.forust
-    ports:
-      - "8085:80"
+    # ports:
+    #   - "8085:80"
     restart: unless-stopped
     volumes:
       - ./forust_files:/usr/share/nginx/html
@@ -42,8 +42,8 @@ services:
     build:
       context: .
       dockerfile: Dockerfile.xdfnx
-    ports:
-      - "8086:80"
+    # ports:
+    #   - "8086:80"
     restart: unless-stopped
     volumes:
       - ./xdfnx_files:/usr/share/nginx/html
@@ -77,7 +77,6 @@ services:
       - "traefik.http.routers.xdfnx-dev.service=xdfnx-homepage"
       - "traefik.http.routers.xdfnx-dev.tls=true"
 
-
 networks:
   proxy:
     external: true
diff --git a/penpot/compose.yaml b/penpot/compose.yaml
index aebb831..3f1c5d8 100644
--- a/penpot/compose.yaml
+++ b/penpot/compose.yaml
@@ -86,8 +86,8 @@ services:
   penpot-frontend:
     image: "penpotapp/frontend:${PENPOT_VERSION:-latest}"
     restart: always
-    ports:
-      - 9001:8080
+    # ports:
+    #   - 9001:8080
 
     volumes:
       - penpot_assets:/opt/data/assets
diff --git a/tailscale/.env.example b/tailscale/.env.example
new file mode 100644
index 0000000..ad82e8d
--- /dev/null
+++ b/tailscale/.env.example
@@ -0,0 +1 @@
+TS_AUTHKEY=tskey-auth-xxxxx-CNTRL
diff --git a/tailscale/compose.yaml b/tailscale/compose.yaml
new file mode 100644
index 0000000..8f8f8b8
--- /dev/null
+++ b/tailscale/compose.yaml
@@ -0,0 +1,21 @@
+services:
+  tailscale:
+    image: tailscale/tailscale:latest
+    container_name: tailscale
+    network_mode: host
+    restart: unless-stopped
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    volumes:
+      - tailscale_data:/var/lib/tailscale
+      - /dev/net/tun:/dev/net/tun
+    environment:
+      - TS_AUTHKEY=${TS_AUTHKEY}
+      - TS_STATE_DIR=/var/lib/tailscale
+      - TS_HOSTNAME=forust-server
+      # - TS_EXTRA_ARGS=--advertise-tags=tag:container
+
+volumes:
+  tailscale_data:
+    name: tailscale_data
diff --git a/termix/compose.yaml b/termix/compose.yaml
index 28051b7..92cdf52 100644
--- a/termix/compose.yaml
+++ b/termix/compose.yaml
@@ -3,8 +3,8 @@ services:
     image: ghcr.io/lukegus/termix:latest
     container_name: termix
     restart: unless-stopped
-    ports:
-      - "3331:8080"
+    # ports:
+    #   - "3331:8080"
     volumes:
       - ./termix-data:/app/data
     environment:
diff --git a/uptime-kuma/compose.yaml b/uptime-kuma/compose.yaml
index 4051573..a918a8e 100644
--- a/uptime-kuma/compose.yaml
+++ b/uptime-kuma/compose.yaml
@@ -5,9 +5,9 @@ services:
     container_name: uptime-kuma
     volumes:
       - ./data:/app/data
-    ports:
+      # ports:
       # <Host Port>:<Container Port>
-      - "3001:3001"
+      # - "3001:3001"
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=proxy"