TautWeekly for Plex v0.17.0

TautWeekly for Plex v0.17.0

v0.17.0 adds optional private Tailscale remote access to the TautWeekly Manager
across every supported package. Authorized devices can open the Manager through
an HTTPS .ts.net address without exposing a router port or enabling Tailscale
Funnel. The shared Settings card shows setup, status, recovery, and the private
address; while an integrated route is active, the entire card has a gentle green
pulse with a static reduced-motion alternative.

For optional mobile use, install and sign in to Tailscale on the phone or
tablet, then open the private address shown by Manager. This remains a private
tailnet flow, not a clientless public URL.

Remote access remains opt-in. TautWeekly does not install Tailscale, create a
Tailscale account, enroll devices, weaken Manager authentication, or silently
publish the service. Access through the tailnet grants full Manager
administration because v0.17.0 has no read-only remote role.

Package integration

• Windows: Enable, Disable, and Verify use a narrowly scoped UAC helper that
  can inspect or change only the exact TautWeekly HTTPS Serve route. Ordinary
  Manager operation remains unelevated. The existing Windows Manager password
  lock remains optional and unchanged.
• Native Linux: a host administrator runs
  sudo tautweekly remote-access-authorize once. This enables a root-owned,
  socket-activated adapter restricted to the tautweekly service account, the
  fixed loopback Manager target, trusted Tailscale CLI paths, bounded output,
  and Inspect, Enable, or Disable actions only. The Manager remains unprivileged.
• macOS Docker Desktop, FreeBSD Podman, generic Docker/NAS, Unraid, and QNAP:
  create private Serve with the host's supported Tailscale client, then paste
  the exact HTTPS .ts.net address into the authenticated Manager and confirm
  that Funnel is off. Manager stores only the hostname and never receives a
  Tailscale credential or host-control permission.
• Compatible Docker hosts without a supported native client: optional
  Compose sidecars provide userspace Tailscale with a fixed private Serve
  configuration, persistent node state, and a file-backed one-off enrollment
  key. They do not use the Docker socket, host networking, a TUN device, added
  Linux capabilities, privileged mode, or Funnel.

The Tailscale provider consent page can preselect Funnel when HTTPS certificates
are first approved. Enable HTTPS certificates only and turn Funnel off before
continuing. TautWeekly never requires public Funnel access.

Update existing installations

Back up private data, then use the documented update path for your package.
No configuration migration is required. Existing credentials, schedules,
generated newsletters, backups, history, and Manager access settings remain
unchanged. Private remote access starts disabled after update.

Windows and native Linux users install or update the official Tailscale client,
sign the host into their tailnet, then use the new Settings card. Container and
NAS users should prefer the vendor-supported host client or plugin; the optional
sidecar is a fallback and requires an administrator-created one-off enrollment
key stored only in the ignored local secret file. Empty that key file after the
node has enrolled and retained its state.

Security and recovery

Integrated adapters accept only one exact HTTPS Serve layout and refuse to
replace or reset an unrelated Tailscale configuration. TautWeekly validates the
.ts.net hostname, adds it to the Manager host allowlist only while enabled,
requires HTTPS origins for remote mutations, uses Secure and SameSite session
cookies, sends HSTS on the private hostname, and retains the existing
authenticated CSRF boundary and login throttling.

Disabling first removes the hostname from Manager's accepted hosts, then removes
only the verified route it owns. If Tailscale is offline or route cleanup cannot
be verified, local Manager access remains the recovery path and the UI reports
the incomplete cleanup. Linux authorization can be revoked only after private
access is disabled. Protect every enrolled device and review tailnet grants;
the Manager password is a second login boundary on non-Windows packages and
when the optional Windows lock is enabled.

Validation

The release passed Manager tests and Go static analysis on Windows and Linux,
Linux helper protocol and route-ownership tests, Linux amd64 and macOS arm64
cross-builds, PowerShell and shell parsing, repository privacy/secret scans,
JSON and Compose validation, accessibility checks, reproducible archive builds,
multi-architecture container builds, and the Windows installer lifecycle.

Live Windows acceptance covered enable and disable, mobile private reachability,
Manager restart, host Tailscale disconnect and reconnect, and Windows reboot
persistence. Automated tests use local or synthetic services and do not contact
real Plex, Tautulli, SMTP, private infrastructure, or provider resources.