---
title: "TSLink v0.3.0: home gateway by default"
description: "New installations use the home gateway. One action grants access, and both entry paths use the same person/app keys, with documented gateway-only exceptions."
url: "https://tslink.md/blog/tslink-v0-3-0"
locale: "en"
product_version: "0.3.0"
source: "https://github.com/anydoor7/tslink/blob/v0.3.0/CHANGELOG.md"
---

> Documentation index: https://tslink.md/llms.txt · Installed binary is authoritative: `tslink manifest`.

TSLink v0.3.0 new installations default to the home gateway. A person outside your tailnet accepts one device share, then you choose which routed private apps they can use. Existing installations keep their mode, including empty registries. Private HTTP/file apps retain their own nodes and URLs; `--portal-only` remains opt-in.

## Grant access in one action

For a registered private app named `photos`, use the person's actual Tailscale login:

```bash
tslink people add alice@example.com --apps photos --for 7d --print-links
```

TSLink checks membership, preserves existing permissions, prepares routes and completes necessary invitations. Invitation creation requires a user-owned Tailscale API token. Send the generated message yourself; invitation links are bearer credentials. The recipient still needs Tailscale and network-policy permission. Incomplete setup returns an error while retaining completed state; waiting for recipient acceptance is a completed owner action.

New `people add` grants default to 24h. `add --allow` and `invite device` keep permanent defaults, and existing deadlines are preserved. An explicit `never` needs acknowledgement; device-invited guests can receive it too. Browser guest links and Funnel remain finite. Expiring MCP bindings and reduced roles retain their duration limits and a 24h omitted lifetime. Read [people sharing](https://tslink.md/docs/people-sharing.md) and [durations](https://tslink.md/docs/durations.md).

## Count traffic across entry paths

Access totals group retained HTTP traffic by person and app, whether it enters through the gateway or the app's own node. Limiting returned events does not reduce totals. Non-human traffic and TCP counters remain separate. Backend failures, refusals and interrupted requests use matching visitor responses on both paths; gateway-specific security checks still have documented exceptions. Retention, drops and crash gaps remain, so this is bounded local history. See [access history](https://tslink.md/docs/access-history.md).

## Upgrade an existing installation

```bash
brew upgrade --cask anydoor7/tap/tslink
# If TSLink runs as a background service:
tslink install
```

Scoop users run `scoop update`, then `scoop update tslink`; other users download the new archive or package. Existing installations keep their mode. To enable the gateway explicitly:

```bash
tslink portal enable --owner you@example.com --gateway
```

Finish enrollment if prompted, then check `tslink status --json`, `tslink doctor --json` and an actual app request from a permitted device. Gateway state uses registry schema 3; follow the [downgrade procedure](https://tslink.md/docs/portal-gateway.md#registry-schema-and-downgrade) before using an older release.

The release also unifies visitor error responses, fixes empty device-invitation lists and preserves original operation failures when completion receipts fail. Binaries use Go 1.27.3 with the X.509 fix described in the [full changelog](https://tslink.md/changelog).

TSLink is an independent project, not made or endorsed by Tailscale. Read the [TSLink v0.3.0 changelog](https://github.com/anydoor7/tslink/blob/v0.3.0/CHANGELOG.md) and [installation guide](https://tslink.md/docs/installation.md).

[Markdown version](https://tslink.md/blog/tslink-v0-3-0.md).