TSLink v0.3.0: home gateway by default

TSLink v0.3.0 new installations default to the home gateway. A person outside your tailnet accepts one device share, then you choose which routed private apps they can use. Existing installations keep their mode, including empty registries. Private HTTP/file apps retain their own nodes and URLs; --portal-only remains opt-in.

Grant access in one action

For a registered private app named photos, use the person's actual Tailscale login:

tslink people add alice@example.com --apps photos --for 7d --print-links

TSLink checks membership, preserves existing permissions, prepares routes and completes necessary invitations. Invitation creation requires a user-owned Tailscale API token. Send the generated message yourself; invitation links are bearer credentials. The recipient still needs Tailscale and network-policy permission. Incomplete setup returns an error while retaining completed state; waiting for recipient acceptance is a completed owner action.

New people add grants default to 24h. add --allow and invite device keep permanent defaults, and existing deadlines are preserved. An explicit never needs acknowledgement; device-invited guests can receive it too. Browser guest links and Funnel remain finite. Expiring MCP bindings and reduced roles retain their duration limits and a 24h omitted lifetime. Read people sharing and durations.

Count traffic across entry paths

Access totals group retained HTTP traffic by person and app, whether it enters through the gateway or the app's own node. Limiting returned events does not reduce totals. Non-human traffic and TCP counters remain separate. Backend failures, refusals and interrupted requests use matching visitor responses on both paths; gateway-specific security checks still have documented exceptions. Retention, drops and crash gaps remain, so this is bounded local history. See access history.

Upgrade an existing installation

brew upgrade --cask anydoor7/tap/tslink
# If TSLink runs as a background service:
tslink install

Scoop users run scoop update, then scoop update tslink; other users download the new archive or package. Existing installations keep their mode. To enable the gateway explicitly:

tslink portal enable --owner you@example.com --gateway

Finish enrollment if prompted, then check tslink status --json, tslink doctor --json and an actual app request from a permitted device. Gateway state uses registry schema 3; follow the downgrade procedure before using an older release.

The release also unifies visitor error responses, fixes empty device-invitation lists and preserves original operation failures when completion receipts fail. Binaries use Go 1.27.3 with the X.509 fix described in the full changelog.

TSLink is an independent project, not made or endorsed by Tailscale. Read the TSLink v0.3.0 changelog and installation guide.

Markdown version.