generated from DAM/ts-TEMPLATE
7a8812a263
- Add serve.json (Tailscale with certs) and serve.headscale.json (Headscale/HTTP-only) - Pin Vikunja to v0.24 - Improve .env.example with comments - Harden .gitignore (env, keys, Tailscale state) - Add SECURITY.md - Update README with configuration and usage instructions - Remove all damconsulting references for generic template use
22 lines
811 B
Markdown
22 lines
811 B
Markdown
# Security Notes
|
|
|
|
## Sensitive Files
|
|
|
|
- `.env` — Contains your Tailscale/Headscale auth key and service configuration. **Never commit this file.**
|
|
- `tailscale/tailscale-data/` — Contains Tailscale node state and keys. **Never commit this directory.**
|
|
|
|
## Capabilities
|
|
|
|
This compose file adds the following capabilities to the Tailscale sidecar:
|
|
|
|
- `net_admin` — Required for Tailscale to manage network interfaces and routes.
|
|
|
|
These capabilities are necessary for Tailscale to function but increase the attack surface if the container is compromised.
|
|
|
|
## Recommendations
|
|
|
|
- Use a dedicated, limited-scope auth key for each service.
|
|
- Regularly rotate auth keys.
|
|
- Review Headscale/Tailscale ACLs to ensure services only have the access they need.
|
|
- Keep the Tailscale Docker image reasonably up to date.
|