Skip to content

tailctl 0.2.0 (withdrawn)

Choose a tag to compare

View all tags
@drycode drycode released this 24 Oct 01:37
· 2 commits to main since this release
v0.2.0
58ae85f

Withdrawn. 0.2.0 refused to load profiles that set auth_key_env without auth_key_ssm, and it was removed from PyPI. Use 0.2.1.

Security release. Upgrade if you run tailctl 0.1.x, especially on a machine that also runs containers.

Security

  • Shields are enforced on every instance. A userspace tailscaled delivers inbound tailnet connections to this machine's 127.0.0.1. In 0.1.x an instance could come up accepting inbound, which exposed every local service to peers the tailnet ACL allowed. up and run now raise shields on spawn and on every reuse. If shields can't be confirmed, they stop the daemon rather than hand it out. tailctl shields [--fix] reports or repairs every running instance and exits 5 on drift. doctor fails on drift too.
  • New listen_host setting. The SOCKS5 and HTTP proxies take no credentials, and some container runtimes (OrbStack, for one) forward host.docker.internal to the host's 127.0.0.1. That lets any container reach a proxy bound there and tunnel into the tailnet. Set listen_host in profiles.yaml to a loopback alias (for example 127.84.67.1, added with ifconfig lo0 alias at boot). The proxies and port forwards then bind it instead. If the address isn't assigned, tailctl refuses to start rather than fall back to 127.0.0.1. The default is unchanged.

Other changes

  • Auth keys can resolve from SSM (auth_key_ssm) when the environment variable is absent. Keys reach tailscale up over stdin, never argv.
  • The registry records each instance's listen address. run, ps and the forwarder read it from there.
  • CI runs the test suite on every push, and releases publish only after it passes.

Upgrading

  • Homebrew: brew upgrade tailctl.
  • pipx: pipx upgrade tailctl.
  • Running instances keep their current settings until their holders exit. After changing listen_host, stop whatever holds instances, run tailctl reset --force (logins are kept), and start the holders again. Make sure only one tailctl is on your PATH, including the PATH your launchd jobs see. An older copy found first will bind 127.0.0.1 and drop listen_host from the registry.
Assets 2
Loading