This is a personal project; only the latest main is supported. Fixes land there.

Report security issues privately, not in a public issue:

• Use GitHub's Report a vulnerability (Security → Advisories), or
• open a minimal public issue asking for a private contact channel — without details.

Expect a best-effort response. There is no bounty.

This role joins hosts to a VPN and edits the firewall. The operator carries real responsibility:

• The auth key is a credential. tailscale_authkey must only ever live in the ansible-vault encrypted group_vars/all/vault.yml. Tasks that handle it set no_log: true; keep it that way. Use pre-authorized, non-reusable keys with short expirations.
• Secrets and site specifics stay out of tracked files. group_vars/, host_vars/, inventory.ini, and .vault_pass are gitignored. Tracked files carry placeholders only.
• Defaults deny. shields_up=true, no accepted routes, no accepted DNS, no exit node, Tailscale SSH off. Loosening any of these is a per-host opt-in — understand what each flag exposes before flipping it.
• Exit-node opt-in changes real attack surface. It enables kernel forwarding, puts tailscale0 in the firewalld trusted zone, enables masquerade, and adds an ACCEPT policy from trusted to ANY. Only enable it on hosts that should route peer traffic.
• The role never runs firewall-cmd --reload. A reload silently drops runtime state added outside permanent config (for example podman/netavark subnet sources). Keep that property in any change.

Reporting a way to extract the vaulted key, bypass shields-up, or widen the firewall beyond the declared single port is especially appreciated.