HarshShah0203/homedex v0.1.5

on GitHub

Plain nginx and Tailscale

Two connectors people asked for. Both are read-only, like everything else in Homedex.

nginx config files (#3)

Traefik, Caddy and Nginx Proxy Manager all have an API Homedex can read. Plain nginx and linuxserver SWAG do not, so Homedex now reads their configuration files from a read-only mount instead. nginx itself does not need to be reachable, and the connector makes no network connections.

• What it reads: the main config and everything reached through include, with globs expanded in sorted order. Symlinks such as sites-enabled are followed only when they stay inside the mount. If the files are mounted somewhere other than where nginx sees them, path_map rewrites nginx's own absolute paths onto the mount.
• What it extracts: each server_name and location with its proxy_pass target, TLS from listen ... ssl, upstream {} groups (one route per member), and set $var substitution, which is how SWAG proxy-confs point at containers. Routes then resolve to containers exactly as they do for the other proxies, and an upstream that points at nothing is flagged broken.
• What it never touches: certificates, keys, htpasswd files and logs are never opened, and raw config is never stored.
• Hostile configs stay harmless. Reads and output are bounded (file size, file count, include depth, names per server, upstream members, expanded variables, total routes), include cycles are detected, and only regular files are opened.

Tailscale (#4)

Reads your tailnet's device list. Each device becomes a host with its tailnet IPs, MagicDNS name and OS, and its "last seen on tailnet" time shows on the Hosts page without filling the change feed.

The useful part is routing: a proxy upstream written as a tailnet IP or MagicDNS name now resolves to the container publishing that port on the same machine. A device is linked to a Docker or SSH host by address first, and by a unique hostname only when no address matches. When the evidence is ambiguous, Homedex leaves it unlinked rather than guess.

• Least privilege: use an OAuth client with a single scope, Devices → Core → Read. An API access token also works, but it carries every permission of the user who made it.
• Data minimization: only the default device fields are requested. Node keys, machine keys, owner emails and connectivity endpoints are never read, and the redaction check in CI now fails if that ever changes.
• Credentials: sealed like every connector secret, never returned by the API, never in errors, never sent over plain http except to loopback, and redirects are not followed.

Also in this release

• Reach the UI from your LAN. HOMEDEX_BIND=0.0.0.0 docker compose up -d --build opens it beyond this machine. The default stays local-only, because until an admin password exists, whoever reaches the page first sets it.
• Podman works as a Docker source through its Docker-compatible API. Tested on Podman 5.8, documented in the connector guide.
• Hosts now show every address a machine is known by.
• Patched the devalue advisory in the web lockfile. The shipped UI bundle was unaffected, and production dependencies remain at zero advisories.

Upgrading

Migration 0008 runs automatically on first start. It rebuilds the hosts and proxies tables in place, keeping every id, note and history entry. Take a backup first as usual; see the upgrade and backup notes.

Setup for both connectors is in the connector guide.

Container images are published to ghcr.io/harshshah0203/homedex.