Files

DAM Updater 6800bd71d6 chore: replace stale draft with canonical ts-TEMPLATE form for ts-homepage

- Replace alternate template form (with {{YOUR_TAILSCALE_AUTHKEY}}, sys_module
  cap, hardcoded homepage.damconsulting.net serve.json) with the canonical
  ts-TEMPLATE pattern: Tailscale sidecar + Homepage, both via network_mode
- Use named volume for config dir; default settings/services/bookmarks/widgets
  files included as starting points for the user to customize
- Add SECURITY.md and proper .gitignore (incl. Homepage's auto-generated
  custom.css/custom.js/docker.yaml/kubernetes.yaml/proxmox.yaml stubs +
  logs/)
- serve.headscale.json now uses the actual MagicDNS base domain
  (homepage.damconsulting.net) so the user has a working starting point
  to edit, not a {{service}} placeholder that doesn't resolve
- Verified: dashboard renders at homepage.damconsulting.net

2026-08-03 15:48:56 -04:00

1.6 KiB

Raw Blame History

Security Notes for ts-homepage

This repository contains the configuration for deploying Homepage behind a Tailscale sidecar.

What's committed

docker-compose.yml — service definitions, image versions, env var references
.env.example — template showing required env vars (no real secrets)
tailscale/config/serve.json — Tailscale serve config (committed generic form)
tailscale/config/serve.headscale.json — Headscale variant for testing
homepage/config/ — dashboard layout files (services, bookmarks, widgets)
README.md — setup instructions

What is NOT committed

.env — contains real authkeys
tailscale/tailscale-data/ — Tailscale node identity state
homepage/images/ — uploaded images
Any volume data

The .gitignore at the repo root blocks accidental commits of these.

Rotation

If a TS_AUTHKEY was ever leaked, revoke it at https://login.tailscale.com/admin/authkeys (or your Headscale equivalent) and generate a new one.

Threat model

This deployment assumes:

The Mac mini is reachable only via Tailscale/Headscale
All access to Homepage goes through the Tailscale sidecar (no exposed ports)
The Tailnet itself is trusted
If you mount the Docker socket, the Homepage container has read access to your Docker daemon — only enable this on a trusted tailnet

If your threat model differs (e.g., you need to expose Homepage to the public internet), review the AllowFunnel setting in tailscale/config/serve.json and the Tailscale ACL controls carefully before proceeding.

Reporting

If you find a security issue with this deployment pattern, contact kevin.riordan@damconsulting.llc.

1.6 KiB Raw Blame History