fix: default mDNS discovery mode to minimal (#1882) (thanks @orlyjamie)

CHANGELOG.md

@@ -36,6 +36,7 @@ Status: unreleased.
 
 ### Fixes
 - Security: harden Tailscale Serve auth by validating identity via local tailscaled before trusting headers.
+- Security: add mDNS discovery mode with minimal default to reduce information disclosure. (#1882) Thanks @orlyjamie.
 - Web UI: improve WebChat image paste previews and allow image-only sends. (#1925) Thanks @smartprogrammer93.
 - Gateway: default auth now fail-closed (token/password required; Tailscale Serve identity remains allowed).
 

src/gateway/server.impl.ts

@@ -352,7 +352,6 @@ export async function startGatewayServer(
       : undefined,
     wideAreaDiscoveryEnabled: cfgAtStart.discovery?.wideArea?.enabled === true,
     tailscaleMode,
-    tailscaleMode,
     mdnsMode: cfgAtStart.discovery?.mdns?.mode,
     logDiscovery,
   });