Files

peskyadmin f652eea021 feat: bring ts-bookstack up to current template spec

- Add SECURITY.md (matches template)
- Add tailscale/config/serve.headscale.json (HTTP-only variant)
- Default serve.json to Tailscale generic with ${TS_CERT_DOMAIN}
- Use linuxserver env var names (DB_USERNAME not DB_USER)
- Use named Docker volumes for cross-platform portability
- Both db and app use network_mode: service:bookstack-ts
- Rewrite README with Tailscale vs Headscale structure
- Rename db service to bookstack-db to avoid collisions with other ts-* repos

2026-08-02 21:46:17 -04:00

1.1 KiB

Raw Blame History

Security Notes

Sensitive Files

.env — Contains your Tailscale/Headscale auth key and service configuration. Never commit this file.
tailscale/tailscale-data/ — Contains Tailscale node state and keys. Never commit this directory.

Capabilities

This compose file adds the following capabilities to the Tailscale sidecar:

net_admin — Required for Tailscale to manage network interfaces and routes.

These capabilities are necessary for Tailscale to function but increase the attack surface if the container is compromised.

Default Passwords & Secrets

The docker-compose.yml and .env files contain placeholder values (***) for sensitive items such as:

Database credentials
Service JWT secret

Change these values before deploying anywhere security matters. Never use the default placeholders in production or shared environments.

Recommendations

Use a dedicated, limited-scope auth key for each service.
Regularly rotate auth keys.
Review Headscale/Tailscale ACLs to ensure services only have the access they need.
Keep the Tailscale Docker image reasonably up to date.