Export, import, backup and restore

What you can do

A private network in mesh-net is a regular headscale network, and it isn't locked in:

• Export — the whole network in one archive;
• move it to your own headscale and keep the devices' addresses, names and keys;
• import a network from your headscale (or from an export) into mesh-net;
• restore a network from its backup at the same address.

Export

1. On the network page, open the Backup tab: Export / backup.
2. Press Download the archive and confirm. The file is named like mesh-net-office-2026-10-05.tar.gz.

Inside: the network's headscale database — the devices with their addresses, names and keys, the routes, the users and the access policy; the server's own key; the settings that must stay the same; and a README in English and Russian with what to set up on your server and the command for each device. mesh-net's own API and join keys are removed from it.

Move to your own headscale

1. Set up headscale 0.28 or newer with:
   • server_url: https://YOUR-HOST — HTTPS on port 443;
   • prefixes exactly 100.64.0.0/10 and fd7a:115c:a1e0::/48, so the devices keep their addresses;
   • policy: mode: database — the access policy is in the database;
   • dns: base_domain of your choice (full MagicDNS names change with it, short names stay).
2. Stop headscale, delete db.sqlite, db.sqlite-wal and db.sqlite-shm in its data directory, put db.sqlite from the archive there (owned by headscale's user) and start it.
3. Create your own API key and join keys: headscale apikeys create, headscale preauthkeys create --user <user id>.
4. On every device, as root or administrator, add every flag the device was brought up with:

   tailscale down
   tailscale up --login-server=https://YOUR-HOST --accept-routes

   No new login is needed: the device keeps its ID, address, name, key and routes. A plain tailscale up --login-server=… on a running device is refused — run tailscale down first.
5. Move gateways (subnet routers, exit nodes) in the same go as the devices that use them.
6. When everything has moved, delete the network in mesh-net: otherwise the devices left there keep a second copy of the network.

The README in the archive has the same steps with your network's values filled in.

Import a network

Bring a network from your own headscale — or one you exported earlier — into mesh-net. It needs the Paid plan and a free reserved name for the new network's address, just like creating one.

1. On My networks press Import at the top right: the form Import a network from your headscale or from an Export archive opens.
2. Pick the Address of the new network.
3. Choose the file: the .tar.gz archive made by Export, or db.sqlite of your headscale.
4. Optionally add your headscale's config.yaml: mesh-net checks its prefixes before anything is created.
5. Press Import in the form. The file is checked first; a bad one is refused and nothing is created. Then the network is created, and its page opens on the move card.

The new network gets the devices with their addresses, names, keys and routes, the users and the access policy. If the policy allows everything, the network gets the visual access rules with the rule “all devices → everything”; any other policy stays as custom HuJSON.

What the import accepts

• A database of headscale 0.23 to 0.28. Older ones have no schema version — update headscale, start it once and copy the database again; newer ones can't be loaded yet.
• Device addresses inside 100.64.0.0/10 and fd7a:115c:a1e0::/48 — the ranges of every mesh-net network — and not reserved by Tailscale.
• Up to 64 MB.
• A consistent copy: stop headscale before copying db.sqlite, or copy it while it runs with:

  sqlite3 /var/lib/headscale/db.sqlite ".backup /tmp/db.sqlite"

  An archive with db.sqlite-wal inside is refused: the copy may lack the latest changes.

Two more things the result message may mention: if the database had no access policy (your headscale kept it in a file), every device reaches every other — set the rules again; devices that logged in through single sign-on (OIDC) work until their key expires, then add them with a join key.

Move the devices

After an import, the network page shows Move your devices here with the commands, and lists the devices with their status — Online here now: N of M devices. counts the ones that have already moved. Run on every device — Linux and macOS:

sudo tailscale down && sudo tailscale up --login-server=https://office.mesh-net.space

Windows, in PowerShell as administrator:

tailscale down; tailscale up --login-server=https://office.mesh-net.space

• Use the network's own address — the card shows it; https://office.mesh-net.space above is an example.
• Add every flag the device was brought up with (--advertise-routes, --accept-routes, --advertise-exit-node, --hostname…): tailscale up doesn't keep the ones you leave out. No new login is needed.
• Move gateways together with the devices that use them: until a gateway moves, its routes are unreachable for the devices that already moved.
• When every device is here, turn the old server off: the devices left there keep a second copy of the network.
• The Tailscale apps for phones and desktops weren't tested with this move: if switching the server in the app asks you to log in, add the device with a join key (Add device).

Hide removes the card when you're done.

Backups

The export archive is also the network's backup. Download it before big changes — new access rules, removing devices, experiments with routes — and keep a few recent ones: the dashboard restores a network only from a file you upload.

Restore from a backup

Restore from a backup brings the network back to the state of an export archive (or of a db.sqlite) at the same address, so the devices from the backup reconnect by themselves. It needs the Paid plan.

1. On the network page, under Export / backup, choose the file in Backup: archive (.tar.gz) or db.sqlite.
2. Tick the box that you understand what is lost and press Restore, then confirm.

After a restore

• The devices that are in the backup reconnect by themselves within a minute; the page shows Restored from the backup and who is online already.
• Devices added after the backup aren't in it. Create a join key with Add device and run on each of them, putting the key in place of KEY:

  sudo tailscale up --login-server=https://office.mesh-net.space --force-reauth --auth-key=KEY

  The device joins as a new one, with a new key; its address may change.
• Visual access rules are applied again from the dashboard; a custom HuJSON policy comes back from the backup. Published services rejoin the network by themselves.
• The restore is recorded in the network's notifications and emailed to the owner.

What isn't in the archive

• mesh-net's settings of the network: published services and notification settings.
• The visual rules, groups and sites as the dashboard keeps them — the archive carries the policy built from them and the devices' routes, not the rules themselves.
• mesh-net's API and join keys.