Approve ironicbadger.network-access.tailscale

[Quick104]

Plugin

• Plugin ID: ironicbadger.network-access.tailscale
• Repository: Silo-Community/silo-plugin-tailscale
• Reviewed release: v0.1.3 (first catalog release, tagged from main after this approval)

Approval evidence

• Repository is public and owned by Silo-Community. Transferred from the author, who keeps admin and is listed in CODEOWNERS.
• make check (Python packaging tests, go test -race ./..., go vet ./..., gofmt) passes locally and in GitHub Actions. CI also builds make dist twice and confirms the archives are byte-identical.
• make audit (govulncheck against published module versions, including the pinned Tailscale dependency) runs in CI.
• Release workflow publishes plugin-linux-amd64, plugin-linux-arm64, plugin-darwin-arm64, the reproducible ZIP archives, and a checksums.txt covering all of them. Binary checksums were checked against the manifest embedded in the ZIP.
• Manifest and README describe the behavior: a tsnet node per API host and proxy, HTTPS listeners for the native, Jellyfin, and Audiobookshelf surfaces, optional auth key and tags, and a Funnel switch that is off by default with an explicit warning.
• Maintainers validated the plugin end to end against the merged server support in feat(plugins): resident network-access providers with proxy-node support Silo-Server/silo-server#1096 (notes in [v1] Tailscale tsnet integration in core Silo-Server/silo-server#1001).
• Network access is limited to Tailscale control and DERP plus the tailnet listeners the plugin itself exposes. Node state and certificates are stored through Silo's encrypted instance state, not on disk.
• The repository declares MIT, CODEOWNERS, GitHub Issues support, and private vulnerability reporting.
• Module, manifest, and release migration reviewed in PR #1.

Decision

Approved for the Silo community catalog on 2026-09-22. The plugin is considered safe for its documented use and has been validated to work as described. Ongoing maintenance and support remain with the author.

Related issue: Silo-Server/silo-server#1001