tailctl 0.2.1

Fixes a regression in 0.2.0. Upgrade if you're on 0.2.0.

Fixed

• 0.2.0 refused to load any profile that set auth_key_env without auth_key_ssm. Every command failed with profile '<name>' has auth_key_env but no auth_key_ssm fallback, including configs that followed the README. The two sources are now independent, and both are optional again.
• auth_key_ssm accepts any SSM parameter name. In 0.2.0 it took only a fixed set of path prefixes, and the AWS profile and region were derived from the path.

New

• auth_key_ssm_profile and auth_key_ssm_region (optional) choose the AWS CLI profile and region for the SSM read. Without them, the read uses your default AWS profile and its configured region. Inherited AWS_* environment variables are still ignored, so an ambient profile or endpoint override can't redirect the read.
• tailctl bootstrap takes --auth-key-ssm-profile and --auth-key-ssm-region. --auth-key-env and --auth-key-ssm no longer have to be given together.

Upgrading

• Homebrew: brew upgrade tailctl.
• pipx: pipx upgrade tailctl.
• If you set auth_key_ssm under 0.2.0, add auth_key_ssm_profile and auth_key_ssm_region to keep reading with the same AWS profile and region. Config written for 0.1.x loads unchanged.

tailctl 0.2.0 (withdrawn)

Withdrawn. 0.2.0 refused to load profiles that set auth_key_env without auth_key_ssm, and it was removed from PyPI. Use 0.2.1.

Security release. Upgrade if you run tailctl 0.1.x, especially on a machine that also runs containers.

Security

• Shields are enforced on every instance. A userspace tailscaled delivers inbound tailnet connections to this machine's 127.0.0.1. In 0.1.x an instance could come up accepting inbound, which exposed every local service to peers the tailnet ACL allowed. up and run now raise shields on spawn and on every reuse. If shields can't be confirmed, they stop the daemon rather than hand it out. tailctl shields [--fix] reports or repairs every running instance and exits 5 on drift. doctor fails on drift too.
• New listen_host setting. The SOCKS5 and HTTP proxies take no credentials, and some container runtimes (OrbStack, for one) forward host.docker.internal to the host's 127.0.0.1. That lets any container reach a proxy bound there and tunnel into the tailnet. Set listen_host in profiles.yaml to a loopback alias (for example 127.84.67.1, added with ifconfig lo0 alias at boot). The proxies and port forwards then bind it instead. If the address isn't assigned, tailctl refuses to start rather than fall back to 127.0.0.1. The default is unchanged.

Other changes

• Auth keys can resolve from SSM (auth_key_ssm) when the environment variable is absent. Keys reach tailscale up over stdin, never argv.
• The registry records each instance's listen address. run, ps and the forwarder read it from there.
• CI runs the test suite on every push, and releases publish only after it passes.

Upgrading

• Homebrew: brew upgrade tailctl.
• pipx: pipx upgrade tailctl.
• Running instances keep their current settings until their holders exit. After changing listen_host, stop whatever holds instances, run tailctl reset --force (logins are kept), and start the holders again. Make sure only one tailctl is on your PATH, including the PATH your launchd jobs see. An older copy found first will bind 127.0.0.1 and drop listen_host from the registry.