tailscale: services.tailscale.serve option broken (set-config doesn't apply HTTPS services)

[hasundue]

Problem

The NixOS option services.tailscale.serve.services.<name>.endpoints."tcp:PORT" = "http://localhost:PORT" generates a config file and applies it via tailscale serve set-config --all. However, set-config creates services as HTTP, not HTTPS. Since the text output of tailscale serve status only shows HTTPS/advertised services, the config appears not to be applied at all.

Context

• tailscale v1.96.5
• set-config --all returns exit code 0 but applies HTTP (not HTTPS) services
• tailscale serve --bg --https 4096 http://localhost:4096 works correctly (HTTPS)
• The config file format (huJSON) has no way to specify "HTTPS": true
• See configs/nixos/default.nix — services.tailscale.serve is currently disabled

Upstream

• Issue #18381 — Tailscale serve set-config registers services as http instead of https tailscale/tailscale#18381
  Tailscale serve set-config registers services as http instead of https

Search

Also check for new issues/PRs matching: serve set-config, HTTPS serve config with the bug or pod/network-features label.

[github-actions]

Issue monitor found new signals for tailscale: services.tailscale.serve option broken:

• Tracked issue updated: tailscale/tailscale#18381 — Tailscale employee hwh33 acknowledged the bug (Apr 28) and confirmed internal tracking. This is part of a broader set of issues around declarative config for Services.
  Tailscale serve set-config registers services as http instead of https tailscale/tailscale#18381 (comment)

• Fix attempt: Contributor @Fryuni investigated the issue and attempted a fix around tls-terminated-tcp (Apr 28). No merged fix yet.

• Related new issue: tailscale/tailscale#19614 — FR to expose service capability flags (e.g. --accept-app-caps) in set-config file format (opened Apr 28). Suggests ongoing gaps in the declarative config approach.
  FR: Expose a way to define service capabilities in the tailscale serve set-config file tailscale/tailscale#19614

Suggested action: The services.tailscale.serve config in configs/nixos/default.nix remains disabled pending this fix. Upstream awareness is confirmed — consider revisiting when a fix ships.

Generated by .github/workflows/issue-monitor.yml.

[Fryuni]

You can use the package from my fork as a workaround. It is linked in the PR you referenced.

Fryuni/config-files@c1a938c

[github-actions]

Issue monitor found a new related issue:

• tailscale/tailscale#19724 — "serve config not reproducing cli" (reported 2026-06, labels: bug, services)
  This describes the same root problem: set-config does not reproduce the behavior of the CLI --https flag. The issue explicitly demonstrates that a service created via serve --https=443 localhost:5678 is stored by get-config and then fails when re-applied via set-config — matching the exact bug tracked here.
  serve config not reproducing cli tailscale/tailscale#19724

No merge has occurred yet on Fryuni's fix PR (#19554). The upstream issue (#18381) remains open with Tailscale tracking internally.

Generated by .github/workflows/issue-monitor.yml.