Only the latest commit on branch main receives security updates.

Report security vulnerabilities privately rather than in public issues:

• Open a private report through GitHub Security Advisories.
• If that channel is unavailable, open an issue requesting private contact instructions without including vulnerability details.

This role manages VPN connectivity and host firewall policies.

• Credential Protection: tailscale_authkey must remain in group_vars/all/vault.yml encrypted with Ansible Vault. Tasks processing the key require no_log: true. Use pre-authorized, single-use keys with short lifetimes.
• Git Hygiene: Keep sensitive parameters and environment data in gitignored files (group_vars/, host_vars/, inventory.ini, .vault_pass). Tracked files contain placeholders only.
• Defensive Defaults: The role enforces shields_up: true, disables accepted routes, disables accepted DNS, disables exit-node advertising, and disables Tailscale SSH.
• Exit Node Isolation: Enabling exit-node routing activates kernel packet forwarding, adds tailscale0 to the firewalld trusted zone, enables masquerading, and configures an ACCEPT forward policy. Enable this setting only on dedicated routing gateways.
• Firewall Stability: The role avoids running firewall-cmd --reload to prevent dropping dynamic container and network rules managed at runtime.