v0.1.1

Bield is a self-hosted control plane for the machines on your tailnet. It's one binary, or one container, that joins your Tailscale or Headscale tailnet and shows every machine in one place: its health and history, its alerts and its containers. Admins can open a terminal, browse files and restart containers from the same page. There are no passwords, because your tailnet is the login. The README says what it does.

This release fixes what an outside review of v0.1.0 found:

• An open terminal closes within 10 seconds of its admin losing the role. It used to stay open until the tab closed.
• Saving in the file editor can't empty the file when the save fails. The editor has the whole text before it touches the file.
• Viewers no longer see Docker's error from starting a container, which can quote its command and paths on the machine.
• The agent (1.3.1) copes with a hostname that has a control character in it. Before, Bield refused every heartbeat from that machine. Update the agent from its page in Bield.
• The Public URL setting counts as one of Bield's own names, so agent install commands and terminals work through it.

Bield can open a shell on every machine you give it SSH access to. Read the security model before you put it on a tailnet you care about.

What has been run

• Go and web tests on every change, against a fake tailnet and a fake SSH server, and a browser smoke test of the demo. Each fix has a test that fails without it.

What has not been run

• Upgrading from v0.1.0 to this release.
• What the v0.1.0 notes list under "What has not been run". Nothing in this release changes that.

Windows and OIDC sign-in aren't in this version. If something doesn't work, open an issue.

Changelog

Features

• 0de159f feat: add a documentation site and finish the landing page checklist (#69)

Fixes

• 7a61988 fix: close the findings from the outside review (#72)

Install

# On a Linux server with systemd
curl -fsSL https://raw.githubusercontent.com/manasseh-fikadu/bield/main/install.sh | sudo BIELD_VERSION=v0.1.1 bash

# In Docker
docker pull ghcr.io/manasseh-fikadu/bield:0.1.1

Verify a download with sha256sum --check --ignore-missing checksums.txt. To upgrade or roll back, see Upgrading.

v0.1.0

Bield is a self-hosted control plane for the machines on your tailnet. It's one binary, or one container, that joins your Tailscale or Headscale tailnet and shows every machine in one place: its health and history, its alerts and its containers. Admins can open a terminal, browse files and restart containers from the same page. There are no passwords, because your tailnet is the login. The README says what it does.

This is the first release. It hasn't had an outside review, and it can open a shell on every machine you give it SSH access to. Read the security model before you put it on a tailnet you care about.

What has been run

• install.sh, as curl | sudo bash, on clean virtual machines: Ubuntu 24.04 (amd64 and arm64), Ubuntu 25.10, Debian 12 and Fedora 43 (arm64). Each reached the Tailscale login link. On Ubuntu 24.04 it was also given an auth key: 13 seconds to install, then Bield joined a real tailnet, served HTTPS there, and made the key's owner its admin.
• Host mode on Ubuntu 24.04 with a real Tailscale, with BIELD_TAILSCALE=host and tailscale set --operator=bield: it listened on the machine's tailnet IPs and served HTTPS.
• arm64 hardware: the linux_arm64 binary and the linux/arm64 image ran natively on Apple silicon (arm64 Linux guests under OrbStack, no emulation), and the darwin_arm64 binary ran directly on the Mac.
• The Docker image on arm64: compose.yaml with an auth key (healthy in 8 seconds, joined the tailnet), and serve --demo.
• Headscale v0.29.7 in Docker: Bield logged in through its login link (approved with headscale auth register), made that user its admin, served plain HTTP with the warning the docs describe, and recognised the same user from a second node on that tailnet.
• compose.host.yaml as shipped, with the latest image and a real Tailscale on the machine (Ubuntu 24.04 with systemd, Docker and tailscaled, in a privileged container): it used the machine's Tailscale, listened on its tailnet IP and made the key's owner the admin. It served plain HTTP, because the container's user isn't the Tailscale operator.
• The macOS arm64 archive, with serve --demo. The agent on a Mac, from the hub's install command to a running LaunchAgent that reported live metrics, and its removal.
• The systemd service with its sandbox in effect (ProtectSystem=strict, NoNewPrivileges and the rest), on Debian 12 in a privileged container: it starts, writes its database and serves the setup page.
• Upgrading from v0.1.0-rc.1 to v0.1.0 with install.sh, on seven installs. A backup was saved first each time. The one logged in to a real tailnet came back with its login, its admin, its SSH key and its pinned host key.
• The terminal and the file manager through Bield on a real machine over SSH (Ubuntu 24.04), and Bield reading that machine's Docker engine.
• Go and web tests on every change, against a fake tailnet and a fake SSH server, and a browser smoke test of the demo.

What has not been run

• Logging in through the login link on Tailscale itself. Those runs used auth keys, and the link flow was run against Headscale.
• Starting, stopping and reading logs and stats of containers on a real Docker engine (the test machine couldn't run containers), and anything past the login under the service's sandbox.
• Bield on a Raspberry Pi in particular, so its small-board limits (memory, SD card speed) are untested.
• Fedora with SELinux enforcing.
• Upgrading from anything but the release candidate.

Windows and OIDC sign-in aren't in this version. If something doesn't work, open an issue.

Changelog

Features

• ab84fd0 feat: add Docker management (#48)
• dbbebec feat: add SSH access and browser terminals (#45)
• bb5054a feat: add a first-run setup and empty states that teach (#53)
• 0a2741d feat: add admin and viewer roles to every route (#38)
• 2ca8d1e feat: add alerts, the activity log and services (#44)
• 6ebffc7 feat: add demo mode, and roll metrics up for 200 devices and 90 days (#58)
• 125cf20 feat: add devices, the network map and hub metrics (#40)
• 68e6b8a feat: add network checks and health score (#43)
• 1819b58 feat: add the Settings page (#50)
• 3acaf89 feat: add the agent, metrics history and per-process usage (#41)
• 68a1b7d feat: add the app shell and design system (#39)
• af0aa63 feat: add the file manager (#47)
• 33ada1f feat: add the sqlite store and migrations (#34)
• 9fa589d feat: add the tailscale layer and sign in with tailscale identity (#35)
• 47c0728 feat: build releases, a Docker image and an install script (#54)
• 0e278a7 feat: enroll each agent with a one-time code and its own secret (#42)
• e8aba36 feat: log in with Tailscale SSH and install the agent over SSH (#52)
• 7386376 feat: polish interactions and mobile (#57)
• 98018e1 feat: redesign the dashboard and add a landing page (#64)
• ca169ee feat: security review before going public (#60)
• 0450fbe feat: send alert notifications to ntfy, Discord, Slack, Telegram, email and webhooks (#51)
• 12a4ae9 feat: set up the go and sveltekit project (#30)
• f9aa7de feat: support Headscale (#59)

Install

# On a Linux server with systemd
curl -fsSL https://raw.githubusercontent.com/manasseh-fikadu/bield/main/install.sh | sudo BIELD_VERSION=v0.1.0 bash

# In Docker
docker pull ghcr.io/manasseh-fikadu/bield:0.1.0

Verify a download with sha256sum --check --ignore-missing checksums.txt. To upgrade or roll back, see Upgrading.