Security Model

Security Model

Boundaries

• Not the official client. The firmware uses the community MicroLink stack. It applies a conservative, fail-closed subset of the tailnet policy to decrypted traffic before forwarding; full official-client policy parity is not claimed. Keep destination-side authentication and ACLs.
• Administration is separate from network authorization. The Web UI admin password protects the device; a rule's source CIDR filters addresses, and an address is not an identity.
• Every Service Gateway rule is a deliberate exposure of one tailnet service on the ESP32's uplink address: rules start disabled, require an allowed-source CIDR and can expire.
• First boot pairs physically (BOOT button or console code), seals setup requests and never forwards traffic from the open setup Wi-Fi.
• Updates come only from this repository's releases, verified against the published digest, into the inactive slot with automatic rollback. Images are not signed and Secure Boot / flash encryption are not enabled.
• No telemetry. No usage reports or crash uploads; GitHub update checks run only when enabled or requested.

Deployment hardening

• Keep the web password enabled and long. Password verifiers use salted PBKDF2-HMAC-SHA256.
• The Web UI is HTTP-only: never forward its port to the Internet or an untrusted VLAN. Use a trusted LAN or the tailnet path.
• Prefer mqtts://, wss:// and https://; protect MQTT/ntfy topics with ACLs and tokens — whoever can publish commands can operate the exposed controls.
• SNMP is off by default, read-only and plaintext: private community, firewall UDP 161, never expose it.
• Disable the access point when not needed; prefer narrow subnet routes.

Reporting a vulnerability

Please report privately as described in the security policy (GitHub private vulnerability reporting). Do not open public issues for security problems.

Details: SECURITY.md · TAILNET-AUTHORIZATION.md.