Files

peskyadmin e71e6f8bf5 feat: improve template structure and documentation

- Add dual serve config (serve.json + serve.headscale.json)
- Add SECURITY.md with default passwords warning
- Add .env.example with clear REQUIRED / REFERENCE / CUSTOMIZE sections
- Rewrite README with clear Tailscale vs Headscale paths
- Harden .gitignore (env files, keys, Tailscale state)
- Update docker-compose.yml with clear section labels
- Make volume names service-specific ({{service}}-db-data)
- Ensure both db and app services depend on the Tailscale sidecar

2026-08-02 19:03:59 -04:00

1.1 KiB

Raw Permalink Blame History

Security Notes

Sensitive Files

.env — Contains your Tailscale/Headscale auth key and service configuration. Never commit this file.
tailscale/tailscale-data/ — Contains Tailscale node state and keys. Never commit this directory.

Capabilities

This compose file adds the following capabilities to the Tailscale sidecar:

net_admin — Required for Tailscale to manage network interfaces and routes.

These capabilities are necessary for Tailscale to function but increase the attack surface if the container is compromised.

Default Passwords & Secrets

The docker-compose.yml and .env files contain placeholder values (***) for sensitive items such as:

Database credentials
Service JWT secret

Change these values before deploying anywhere security matters. Never use the default placeholders in production or shared environments.

Recommendations

Use a dedicated, limited-scope auth key for each service.
Regularly rotate auth keys.
Review Headscale/Tailscale ACLs to ensure services only have the access they need.
Keep the Tailscale Docker image reasonably up to date.