# Security Notes for ts-homepage

This repository contains the configuration for deploying Homepage behind a Tailscale sidecar.

## What's committed

- `docker-compose.yml` — service definitions, image versions, env var references
- `.env.example` — template showing required env vars (no real secrets)
- `tailscale/config/serve.json` — Tailscale serve config (committed generic form)
- `tailscale/config/serve.headscale.json` — Headscale variant for testing
- `homepage/config/` — dashboard layout files (services, bookmarks, widgets)
- `README.md` — setup instructions

## What is NOT committed

- `.env` — contains real authkeys
- `tailscale/tailscale-data/` — Tailscale node identity state
- `homepage/images/` — uploaded images
- Any volume data

The `.gitignore` at the repo root blocks accidental commits of these.

## Rotation

- If a `TS_AUTHKEY` was ever leaked, revoke it at https://login.tailscale.com/admin/authkeys (or your Headscale equivalent) and generate a new one.

## Threat model

This deployment assumes:
- The Mac mini is reachable only via Tailscale/Headscale
- All access to Homepage goes through the Tailscale sidecar (no exposed ports)
- The Tailnet itself is trusted
- If you mount the Docker socket, the Homepage container has read access to your Docker daemon — only enable this on a trusted tailnet

If your threat model differs (e.g., you need to expose Homepage to the public internet), review the `AllowFunnel` setting in `tailscale/config/serve.json` and the Tailscale ACL controls carefully before proceeding.

## Reporting

If you find a security issue with this deployment pattern, contact kevin.riordan@damconsulting.llc.