diff --git a/security/headscale/Makefile b/security/headscale/Makefile
new file mode 100644
index 0000000..3691fef
--- /dev/null
+++ b/security/headscale/Makefile
@@ -0,0 +1,48 @@
+PORTNAME=	headscale
+PORTVERSION=	0.22.3
+PORTREVISION=	1
+DISTVERSIONPREFIX=	v
+CATEGORIES=	security net-vpn
+
+MAINTAINER=	m.muenz@gmail.com
+COMMENT=	Mesh VPN that makes it easy to connect your devices
+WWW=		https://github.com/juanfont/headscale
+
+LICENSE=	BSD3CLAUSE
+LICENSE_FILE=	${WRKSRC}/LICENSE
+
+BROKEN_aarch64=	fails to compile: modernc.org/libc
+BROKEN_armv6=	fails to compile: modernc.org/libc
+BROKEN_armv7=	fails to compile: modernc.org/libc
+
+RUN_DEPENDS=	ca_root_nss>0:security/ca_root_nss
+
+USES=		go:modules
+USE_RC_SUBR=	headscale
+
+GO_MODULE=	github.com/juanfont/headscale
+
+GO_TARGET=	./cmd/headscale
+
+PLIST_FILES=	"@sample ${ETCDIR}/config.yaml.sample" \
+		"@dir /var/cache/${PORTNAME}" \
+		"@dir /var/db/${PORTNAME}" \
+		bin/${PORTNAME}
+
+post-patch:
+	@${REINPLACE_CMD} -e 's|/etc/headscale|${PREFIX}/etc/${PORTNAME}|g' \
+		${WRKSRC}/cmd/headscale/cli/utils.go
+	@${REINPLACE_CMD} -e 's|/var/lib/headscale/db.sqlite|/var/db/${PORTNAME}/db.sqlite|g' \
+		${WRKSRC}/config-example.yaml
+	@${REINPLACE_CMD} -e 's|/var/lib/headscale/cache|/var/cache/${PORTNAME}|g' \
+		${WRKSRC}/config-example.yaml
+	@${REINPLACE_CMD} -e 's|/var/lib/headscale/private.key|${PREFIX}/etc/${PORTNAME}/private.key|g' \
+		${WRKSRC}/config-example.yaml
+
+post-install:
+	${MKDIR} ${STAGEDIR}${PREFIX}/etc/${PORTNAME}
+	${INSTALL_DATA} ${WRKSRC}/config-example.yaml ${STAGEDIR}${PREFIX}/etc/${PORTNAME}/config.yaml.sample
+	${MKDIR} ${STAGEDIR}/var/db/${PORTNAME}
+	${MKDIR} ${STAGEDIR}/var/cache/${PORTNAME}
+
+.include <bsd.port.mk>
diff --git a/security/headscale/distinfo b/security/headscale/distinfo
new file mode 100644
index 0000000..aaf3c27
--- /dev/null
+++ b/security/headscale/distinfo
@@ -0,0 +1,5 @@
+TIMESTAMP = 1701014751
+SHA256 (go/security_headscale/headscale-v0.22.3/v0.22.3.mod) = e233446c8c4919e192d85b964577e6bc62ba25063c45ba721bdf8ba2a8e0d49f
+SIZE (go/security_headscale/headscale-v0.22.3/v0.22.3.mod) = 6948
+SHA256 (go/security_headscale/headscale-v0.22.3/v0.22.3.zip) = fb37498c80cdc689b84f387d44f75f141baa01917bd5ab14669ac4f7ea29793e
+SIZE (go/security_headscale/headscale-v0.22.3/v0.22.3.zip) = 712113
diff --git a/security/headscale/files/headscale.in b/security/headscale/files/headscale.in
new file mode 100644
index 0000000..a3f4ada
--- /dev/null
+++ b/security/headscale/files/headscale.in
@@ -0,0 +1,41 @@
+#!/bin/sh
+
+# PROVIDE: headscale
+# REQUIRE: NETWORKING
+# KEYWORD: shutdown
+#
+
+. /etc/rc.subr
+
+name=headscale
+rcvar=headscale_enable
+
+load_rc_config $name
+
+: ${headscale_enable:="NO"}
+: ${headscale_syslog_output_enable:="NO"}
+: ${headscale_syslog_output_priority:="info"}
+: ${headscale_syslog_output_facility:="daemon"}
+
+if checkyesno headscale_syslog_output_enable; then
+	headscale_syslog_output_flags="-t ${name} -T ${name}"
+
+	if [ -n "${headscale_syslog_output_priority}" ]; then
+		headscale_syslog_output_flags="${headscale_syslog_output_flags} -s ${headscale_syslog_output_priority}"
+	fi
+
+	if [ -n "${headscale_syslog_output_facility}" ]; then
+		headscale_syslog_output_flags="${headscale_syslog_output_flags} -l ${headscale_syslog_output_facility}"
+	fi
+fi
+
+pidfile=/var/run/${name}.pid
+procname="%%PREFIX%%/bin/${name}"
+
+start_cmd="${name}_start"
+
+headscale_start() {
+	/usr/sbin/daemon -f ${headscale_syslog_output_flags} -p ${pidfile} ${procname} serve
+}
+
+run_rc_command "$1"
diff --git a/security/headscale/pkg-descr b/security/headscale/pkg-descr
new file mode 100644
index 0000000..f8a11ed
--- /dev/null
+++ b/security/headscale/pkg-descr
@@ -0,0 +1 @@
+An open source, self-hosted implementation of the Tailscale coordination server.