TautWeekly for Plex v0.25.0

Released: 2026-08-31

Public remote access on every maintained package

Every maintained TautWeekly package can now use Tailscale Funnel for optional public HTTPS
access. A remote viewer opens the generated stable .ts.net address in an
ordinary browser; the viewer does not install Tailscale or connect to a VPN.
Native Managers remain bound to 127.0.0.1. Container Managers listen only
inside their isolated network namespace, publish host recovery on
127.0.0.1:8787, and give Funnel only the fixed container-local loopback
target. No package creates a broad host bind, router port, or firewall rule.

On Windows and native Linux, install the official Tailscale client, start it,
and sign in on the native host. Container packages include the pinned official
userspace runtime but require an explicit interactive administrator sign-in.
TautWeekly does not silently install or authenticate Tailscale and never
accepts an auth key or token. On native Linux, authorize the fixed one-shot adapter with sudo tautweekly remote-access-authorize; on Windows, each change uses the fixed
administrator-approved helper. Under Settings > Browser access, create and
enable a unique Manager password. Then use Settings > Tailscale Funnel to
enable the fixed route, complete any one-time provider approval, and Verify.
The host administrator must provide MagicDNS, HTTPS certificates, and a
matching funnel node attribute. Tagged service nodes require an explicit
tag-targeted attribute because the default member target is not their identity.
TautWeekly neither inspects nor edits that policy.

The shared provider-neutral controller owns the state machine, password gate,
fixed target, exact route checks, Host admission, public DNS/trusted-TLS
postconditions, and fail-closed cleanup. The browser never supplies a command,
executable, CLI argument, hostname, port, target, or path.

Funnel makes the Manager login page publicly reachable over HTTPS. Every
sensitive endpoint remains authenticated, mutations retain CSRF and exact
same-origin checks, and remote cookies remain Secure, HttpOnly, and SameSite.
There is no read-only role. This release adds no new Internet login-attempt
limiter, so use a unique Manager password and treat brute-force attempts as a
remaining risk.

Fail-closed lifecycle

Funnel cannot be enabled without an active password lock. Disabling that lock,
using local access reset, or uninstalling first disables and verifies only the
exact TautWeekly-owned Funnel. If shutdown cannot be verified, the lock or
application remains in place. Password changes keep Funnel available and keep
the current session, while other sessions are revoked.

Normal Manager restart preserves the selected persistent Funnel route for the
next start. Explicit Windows tray Exit and installer update first disable and
verify the route. Updates preserve configuration, password verification
material, history, previews, and schedule, but Funnel remains off for explicit
re-enable. Removal preserves the private data directory after verified Funnel
cleanup. An older
exact Windows private Serve route is blocked and requires an explicit Funnel
enable migration or disable cleanup.

Native Linux explicit stop, update, access reset, adapter revocation, and
uninstall first disable and verify the exact owned route. Upgrade preserves
configuration, password verification material, history, previews, and
schedule; Funnel remains off for explicit re-enable. The root helper
accepts only the installed service UID, fixed operations, and
http://127.0.0.1:8788; Manager never receives root, sudo, systemd, or
general Tailscale control.

After an install or update, the Windows launcher always sends the validated
loopback Dashboard URL to the browser. Focusing an already-open Dashboard is
only a convenience; it no longer substitutes for navigation, because that
window may still contain the pre-update Manager document.

Scope

Native Windows and native Linux use their narrow host adapters. NAS/Docker,
QNAP, Synology and other compatible NAS systems, Unraid, macOS Docker Desktop,
and FreeBSD Podman use an integrated root-only userspace adapter built from the
pinned official Tailscale image. It owns separate state and only the fixed
container-local Manager target. The non-root Manager has no Docker/Podman
socket, host executable, host network, TUN device, added networking capability,
auth key, token, or arbitrary CLI input. The browser submits only typed
enable/disable/verify operations.

Generic Compose, QNAP, macOS, and FreeBSD retain their explicit loopback
mapping. The Unraid template now owns a fixed
127.0.0.1:8787:8080/tcp recovery publish rather than a generated broad Port
entry; initial setup/recovery from another workstation uses an SSH local
forward. Once enabled and independently verified, Funnel is the only public
ordinary-browser path for these packages.

The old Compose sidecar, static Serve configuration, auth-key file, private URL
input, and Funnel-off confirmation have been removed. Legacy exact-owned Serve
state is recognized only for explicit migration or cleanup and is never a
supported deployment architecture.

The complete package inventory and architecture are documented in
Remote access architecture and platform support.

Acceptance matrix

Release validation uses sanitized fixtures and no committed runtime state. Live
public acceptance was limited to the native Windows row described below; the
remaining lifecycle rows are exercised virtually and by package CI:

Sanitized Windows network validation reproduced a stale per-hostname
control-plane condition: the original Funnel name remained public NXDOMAIN,
while a renamed host published public A and AAAA answers and both tested IPv4
edges completed trusted TLS and returned HTTP 200. Restoring the original name
reproduced NXDOMAIN; restoring the new name restored publication. The corrected
candidate also bypasses Windows NRPT/MagicDNS for its fixed public-resolver
query. On 2026-08-31, the installed verifier candidate retained the required
Manager password lock, reported the exact loopback target, and reached green
Active. The user accepted that live result for the combined rollout.

That update also exposed a legacy folder-picker problem before publication.
The release now reads the validated current-user registration through the
native Windows Registry API and uses an existing installation directory
directly for Update or Migrate. New and unresolved installations still require
an explicit folder choice; isolated installer lifecycle tests cover the
registered custom-folder case.

tailscale/tailscale#19508
remains open and documents the broader Windows class where the local route is
configured while public DNS publication is absent.
Open #11849,
#8680, and
#19290 demonstrate that
the same local-success/public-failure class also spans Linux, iOS, Docker
userspace networking, public DNS resolution, and CDN-edge TLS. Local
Funnel on is therefore insufficient on every platform. Do not create an A
record, open firewall/router ports, repeatedly reset certificates, or replace
the transport. The acceptance result proves this host and hostname, not that
every upstream control-plane failure class is resolved.