Files

DAM Updater d9570eb0e1 chore: replace stale draft with canonical ts-TEMPLATE form for ts-focalboard

- Replace alternate template form (with {{YOUR_TAILSCALE_AUTHKEY}}, sys_module
  cap, {{service-compose}} placeholder) with the canonical ts-TEMPLATE pattern:
  Tailscale sidecar + Focalboard, both via network_mode namespace
- Use SQLite by default (Focalboard's stock behavior); Postgres mode
  documented in README with config.json mount instructions
- Pin to mattermost/focalboard:7.11.4
- Add SECURITY.md and proper .gitignore (incl. focalboard/config.json
  exclude so Postgres config files stay out of repo)
- Note: official Focalboard image is amd64-only; runs via emulation
  on arm64 hosts (Apple Silicon)
- Verified: setup wizard renders, first-time account creation works

2026-08-03 15:23:14 -04:00

1.5 KiB

Raw Permalink Blame History

Security Notes for ts-focalboard

This repository contains the configuration for deploying Focalboard behind a Tailscale sidecar.

What's committed

docker-compose.yml — service definitions, image versions, env var references
.env.example — template showing required env vars (no real secrets)
tailscale/config/serve.json — Tailscale serve config (committed generic form)
tailscale/config/serve.headscale.json — Headscale variant for testing
README.md — setup instructions

What is NOT committed

.env — contains real authkeys, database passwords
tailscale/tailscale-data/ — Tailscale node identity state
Any volume data

The .gitignore at the repo root blocks accidental commits of these.

Rotation

If a TS_AUTHKEY was ever leaked, revoke it at https://login.tailscale.com/admin/authkeys (or your Headscale equivalent) and generate a new one.
The POSTGRES_PASSWORD in .env only needs rotation if the database was exposed beyond the tailnet.

Threat model

This deployment assumes:

The Mac mini is reachable only via Tailscale/Headscale
All access to Focalboard goes through the Tailscale sidecar (no exposed ports)
The Tailnet itself is trusted

If your threat model differs (e.g., you need to expose Focalboard to the public internet), review the AllowFunnel setting in tailscale/config/serve.json and the Tailscale ACL controls carefully before proceeding.

Reporting

If you find a security issue with this deployment pattern, contact kevin.riordan@damconsulting.llc.

1.5 KiB Raw Permalink Blame History