Repository navigation
fix: survive target reinstalls, surface unapplied serves, dial 127.0.0.1 (1.102.4:1) - #14
Merged
Merged
Conversation
This was referenced Sep 20, 2026
…0.1; 1.102.4:0 → 1.102.4:1 A serve route now reads its target's host reactively, in main and in the url-v0 export, so a target that is reinstalled gets its forwarder and its address row back on its own (#8). Adding a serve that already exists refreshes it instead of failing, and a port held by a route whose target was uninstalled is released to the new serve. `tailscale serve --bg` exits 0 without applying anything when HTTPS Certificates are not enabled for the tailnet (enableFeatureInteractive prints the enablement URL and os.Exit(0)s), so the apply oneshots prove nothing. A standalone "Tailscale Serve" health check compares `tailscale serve status --json` against the saved routes and fails naming the ones missing; disabled with no routes, waiting until signed in (#9). It requires only tailscaled: requiring the apply oneshots would leave a hard-failing apply as a bare "waiting" forever. Serve targets dial 127.0.0.1 instead of localhost: an IP literal sends no SNI, which is all a target's SSL bridge port answers on StartOS 0.4.0.2 (#7, taken from #11). Verified on a 0.4.0.2 box with no tailnet: add, re-add, live-port collision and orphaned-port release through the actions; the address row returning after the target was uninstalled and reinstalled; the health check's disabled and waiting states. The check's signed-in states (success, failure naming the route) are unverified. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
helix-a
force-pushed
the
fix/serve-routes
branch
from
September 20, 2026 19:06
9df1e3e to
56291ff
Compare
MattDHill
approved these changes
Sep 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainand in the url-v0 export, so a target that is reinstalled gets its forwarder and its address row back on its own. Adding a serve that already exists refreshes it instead of failing, and a port held by a route whose target was uninstalled is released to the new serve.tailscale serve status --jsonagainst every saved route whose target still resolves and fails naming any that are not applied.tailscale serve --bgexits 0 without applying anything when HTTPS Certificates are not enabled for the tailnet (enableFeatureInteractiveprints the enablement URL andos.Exit(0)s), so the apply oneshots prove nothing on their own. The check is disabled with no routes and waiting until the node is signed in, and requires onlytailscaled: requiring the apply oneshots would leave a hard-failing apply as a bare "waiting" forever.127.0.0.1instead oflocalhost, so no SNI reaches a target's SSL bridge port on StartOS 0.4.0.2 (the part of fix: dial a target's SSL bridge port without SNI; move to start-sdk 3.0 #11 that does not need start-sdk 3.0).1.102.4:0→1.102.4:1; README and instructions updated.Closes #8. Closes #9. Refs #7, #11.
Verified
On a 0.4.0.2 box with no tailnet, with a MagicDNS name seeded into
ts-status.json: add, re-add, live-port collision and orphaned-port release through the actions; the address row returning after the target package was uninstalled and reinstalled; the forwarder relaunching with it; the health check's disabled and waiting states.Not verified: the check's signed-in states (success, and failure naming the route). That needs a signed-in node.