generated from DAM/ts-TEMPLATE
DAM Updater
6800bd71d6
- Replace alternate template form (with {{YOUR_TAILSCALE_AUTHKEY}}, sys_module
cap, hardcoded homepage.damconsulting.net serve.json) with the canonical
ts-TEMPLATE pattern: Tailscale sidecar + Homepage, both via network_mode
- Use named volume for config dir; default settings/services/bookmarks/widgets
files included as starting points for the user to customize
- Add SECURITY.md and proper .gitignore (incl. Homepage's auto-generated
custom.css/custom.js/docker.yaml/kubernetes.yaml/proxmox.yaml stubs +
logs/)
- serve.headscale.json now uses the actual MagicDNS base domain
(homepage.damconsulting.net) so the user has a working starting point
to edit, not a {{service}} placeholder that doesn't resolve
- Verified: dashboard renders at homepage.damconsulting.net
40 lines
1.6 KiB
Markdown
40 lines
1.6 KiB
Markdown
# Security Notes for ts-homepage
|
|
|
|
This repository contains the configuration for deploying Homepage behind a Tailscale sidecar.
|
|
|
|
## What's committed
|
|
|
|
- `docker-compose.yml` — service definitions, image versions, env var references
|
|
- `.env.example` — template showing required env vars (no real secrets)
|
|
- `tailscale/config/serve.json` — Tailscale serve config (committed generic form)
|
|
- `tailscale/config/serve.headscale.json` — Headscale variant for testing
|
|
- `homepage/config/` — dashboard layout files (services, bookmarks, widgets)
|
|
- `README.md` — setup instructions
|
|
|
|
## What is NOT committed
|
|
|
|
- `.env` — contains real authkeys
|
|
- `tailscale/tailscale-data/` — Tailscale node identity state
|
|
- `homepage/images/` — uploaded images
|
|
- Any volume data
|
|
|
|
The `.gitignore` at the repo root blocks accidental commits of these.
|
|
|
|
## Rotation
|
|
|
|
- If a `TS_AUTHKEY` was ever leaked, revoke it at https://login.tailscale.com/admin/authkeys (or your Headscale equivalent) and generate a new one.
|
|
|
|
## Threat model
|
|
|
|
This deployment assumes:
|
|
- The Mac mini is reachable only via Tailscale/Headscale
|
|
- All access to Homepage goes through the Tailscale sidecar (no exposed ports)
|
|
- The Tailnet itself is trusted
|
|
- If you mount the Docker socket, the Homepage container has read access to your Docker daemon — only enable this on a trusted tailnet
|
|
|
|
If your threat model differs (e.g., you need to expose Homepage to the public internet), review the `AllowFunnel` setting in `tailscale/config/serve.json` and the Tailscale ACL controls carefully before proceeding.
|
|
|
|
## Reporting
|
|
|
|
If you find a security issue with this deployment pattern, contact kevin.riordan@damconsulting.llc.
|