v0.6.0

Added

• Request ACL tags with advertise_tags before login or through configuration
  updates, with tag validation and sorted, unique replacement lists. Grants still
  require tailnet tagOwners permission; updates never force re-authentication.
• Observe control-plane-granted tags at ["self", "tags"] and
  ["peers", id, "tags"], independently of requested tags.

v0.5.0

Added

• Bootstrap installation before target dependencies compile by preloading the Mix
  task from source with an explicit architecture.
• Explicit installer version and SHA-256 pins, verified archive caching, offline
  installation, and reuse of identical installed binaries without rewriting them.
• Tailscaled.Installer.install!/2 for setup scripts without Mix or application startup.

v0.4.0

Added

• Tailscaled.Testing.auth_key/1 creates short-lived, single-use auth keys for tests
  and CI from a GitHub Actions OIDC identity through Tailscale workload identity
  federation.

v0.3.0

Breaking changes

• Use /data/tailscaled_ex on Nerves and ~/.local/share/tailscaled_ex elsewhere
  for default identity storage.

v0.2.0

Breaking changes

• Rename the package and OTP application from :tailscale to :tailscaled_ex,
  and the module namespace and subscription message tag from Tailscale to
  Tailscaled. Update application configuration, calls, and message patterns.
• Rename the installer task from mix tailscale.install to mix tailscaled.install.
  Existing identity storage paths remain unchanged; no re-enrollment is needed.
• Default accept_dns to false for complete configuration replacement and reset.
  Startup, login, and partial updates do not override saved DNS preferences.

Added

• Supervised daemon management and external-daemon attachment through LocalAPI.
• Browser and auth-key login, logout, HTTPS Serve, cached state, and subscriptions.
• Partial configuration updates that preserve omitted settings.
• refresh_configuration/0 to explicitly refresh cached settings after external changes,
  including Serve edits that do not emit daemon notifications.
• up/0 and down/0 commands with running-preference readback, without logging out
  or resetting configuration. These do not guarantee termination of existing forwarding.
• Target-aware installation of the tested daemon with SHA-256 verification.

Fixed

• Reject a hostname change combined with nonempty Serve configuration before writing,
  rather than binding Serve to the previous DNS name.
• Clear cached identity, peers, and authentication state when the daemon resets its profile.
• Return a validation error for invalid UTF-8 Serve targets instead of crashing the controller.

Security

• Redact enrollment URLs and raw notifications from formatted monitor status and crash
  reports, and redact HTTP(S) URLs in health warnings printed by info/0.
• Keep auth keys out of controller diagnostic output, including OTP debug logs.

Compatibility

• Requires Linux, Elixir 1.19 or later, and OTP 28 or later.
• Tested with Tailscale 1.102.3; later 1.x versions require compatibility testing.