diff --git a/core/headscale/Dockerfile b/core/headscale/Dockerfile
new file mode 100644
index 0000000..5d76932
--- /dev/null
+++ b/core/headscale/Dockerfile
@@ -0,0 +1,6 @@
+FROM headscale/headscale:0.22.3
+
+ARG TARGETARCH
+
+COPY server_${TARGETARCH} /usr/bin/headscale-api
+RUN chmod +x /usr/bin/headscale-api
diff --git a/core/headscale/Makefile b/core/headscale/Makefile
new file mode 100644
index 0000000..57ec3d8
--- /dev/null
+++ b/core/headscale/Makefile
@@ -0,0 +1,20 @@
+clean:
+	rm -f server_*
+
+build_arm64: export CGO_ENABLED=0
+build_arm64: export GO111MODULE=on
+build_arm64: export GOOS=linux
+build_arm64: export GOARCH=arm64
+build_arm64:
+	go build -o server_arm64 *.go
+
+build_amd64: export CGO_ENABLED=0
+build_amd64: export GO111MODULE=on
+build_amd64: export GOOS=linux
+build_amd64: export GOARCH=amd64
+build_amd64:
+	go build -o server_amd64 *.go
+
+push: clean build_arm64 # build_amd64
+	podman build --tag=giolekva/headscale-api:latest .
+	podman push giolekva/headscale-api:latest
diff --git a/core/headscale/client.go b/core/headscale/client.go
new file mode 100644
index 0000000..9147629
--- /dev/null
+++ b/core/headscale/client.go
@@ -0,0 +1,39 @@
+package main
+
+import (
+	"fmt"
+	"os/exec"
+)
+
+type client struct {
+	config string
+}
+
+func newClient(config string) *client {
+	return &client{
+		config: fmt.Sprintf("--config=%s", config),
+	}
+}
+
+func (c *client) createUser(name string) error {
+	cmd := exec.Command("headscale", c.config, "users", "create", name)
+	out, err := cmd.Output()
+	fmt.Println(string(out))
+	return err
+}
+
+func (c *client) createPreAuthKey(user string) (string, error) {
+	// TODO(giolekva): make expiration configurable, and auto-refresh
+	cmd := exec.Command("headscale", c.config, "--user", user, "preauthkeys", "create", "--reusable", "--expiration", "365d")
+	out, err := cmd.Output()
+	fmt.Println(string(out))
+	return string(out), err
+}
+
+func (c *client) enableRoute(id string) error {
+	// TODO(giolekva): make expiration configurable, and auto-refresh
+	cmd := exec.Command("headscale", c.config, "routes", "enable", "-r", id)
+	out, err := cmd.Output()
+	fmt.Println(string(out))
+	return err
+}
diff --git a/core/headscale/go.mod b/core/headscale/go.mod
new file mode 100644
index 0000000..783dc19
--- /dev/null
+++ b/core/headscale/go.mod
@@ -0,0 +1,17 @@
+module github.com/giolekva/pcloud/core/headscale
+
+go 1.18
+
+require github.com/labstack/echo/v4 v4.10.2
+
+require (
+	github.com/labstack/gommon v0.4.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.17 // indirect
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
+	github.com/valyala/fasttemplate v1.2.2 // indirect
+	golang.org/x/crypto v0.6.0 // indirect
+	golang.org/x/net v0.7.0 // indirect
+	golang.org/x/sys v0.5.0 // indirect
+	golang.org/x/text v0.7.0 // indirect
+)
diff --git a/core/headscale/go.sum b/core/headscale/go.sum
new file mode 100644
index 0000000..64dbbfd
--- /dev/null
+++ b/core/headscale/go.sum
@@ -0,0 +1,40 @@
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/labstack/echo/v4 v4.10.2 h1:n1jAhnq/elIFTHr1EYpiYtyKgx4RW9ccVgkqByZaN2M=
+github.com/labstack/echo/v4 v4.10.2/go.mod h1:OEyqf2//K1DFdE57vw2DRgWY0M7s65IVQO2FzvI4J5k=
+github.com/labstack/gommon v0.4.0 h1:y7cvthEAEbU0yHOf4axH8ZG2NH8knB9iNSoTO8dyIk8=
+github.com/labstack/gommon v0.4.0/go.mod h1:uW6kP17uPlLJsD3ijUYn3/M5bAxtlZhMI6m3MFxTMTM=
+github.com/mattn/go-colorable v0.1.11/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng=
+github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
+github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
+github.com/valyala/fasttemplate v1.2.1/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
+github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=
+github.com/valyala/fasttemplate v1.2.2/go.mod h1:KHLXt3tVN2HBp8eijSv/kGJopbvo7S+qRAEEKiv+SiQ=
+golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211103235746-7861aae1554b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/text v0.7.0 h1:4BRB4x83lYWy72KwLD/qYDuTu7q9PjSagHvijDw7cLo=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/core/headscale/main.go b/core/headscale/main.go
new file mode 100644
index 0000000..a2e429c
--- /dev/null
+++ b/core/headscale/main.go
@@ -0,0 +1,73 @@
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+
+	"github.com/labstack/echo/v4"
+)
+
+var port = flag.Int("port", 3000, "Port to listen on")
+var config = flag.String("config", "", "Path to headscale config")
+
+type server struct {
+	port   int
+	client *client
+}
+
+func newServer(port int, client *client) *server {
+	return &server{
+		port,
+		client,
+	}
+}
+
+func (s *server) start() {
+	e := echo.New()
+	e.POST("/user/:user/preauthkey", s.createReusablePreAuthKey)
+	e.POST("/user", s.createUser)
+	e.POST("/routes/:id/enable", s.enableRoute)
+	log.Fatal(e.Start(fmt.Sprintf(":%d", s.port)))
+}
+
+type createUserReq struct {
+	Name string `json:"name"`
+}
+
+func (s *server) createUser(c echo.Context) error {
+	var req createUserReq
+	if err := json.NewDecoder(c.Request().Body).Decode(&req); err != nil {
+		return err
+	}
+	if err := s.client.createUser(req.Name); err != nil {
+		return err
+	} else {
+		return c.String(http.StatusOK, "")
+	}
+}
+
+func (s *server) createReusablePreAuthKey(c echo.Context) error {
+	if key, err := s.client.createPreAuthKey(c.Param("user")); err != nil {
+		return err
+	} else {
+		return c.String(http.StatusOK, key)
+	}
+}
+
+func (s *server) enableRoute(c echo.Context) error {
+	if err := s.client.enableRoute(c.Param("id")); err != nil {
+		return err
+	} else {
+		return c.String(http.StatusOK, "")
+	}
+}
+
+func main() {
+	flag.Parse()
+	c := newClient(*config)
+	s := newServer(*port, c)
+	s.start()
+}