tailscale: services.tailscale.serve option broken (set-config doesn't apply HTTPS services)

[hasundue]

Problem

The NixOS option services.tailscale.serve.services.<name>.endpoints."tcp:PORT" = "http://localhost:PORT" generates a config file and applies it via tailscale serve set-config --all. However, set-config creates services as HTTP, not HTTPS. Since the text output of tailscale serve status only shows HTTPS/advertised services, the config appears not to be applied at all.

Context

• tailscale v1.96.5
• set-config --all returns exit code 0 but applies HTTP (not HTTPS) services
• tailscale serve --bg --https 4096 http://localhost:4096 works correctly (HTTPS)
• The config file format (huJSON) has no way to specify "HTTPS": true
• See configs/nixos/default.nix — services.tailscale.serve is currently disabled

Upstream

• Issue #18381 — Tailscale serve set-config registers services as http instead of https tailscale/tailscale#18381
  Tailscale serve set-config registers services as http instead of https

Search

Also check for new issues/PRs matching: serve set-config, HTTPS serve config with the bug or pod/network-features label.

[github-actions]

Issue monitor found new signals for tailscale: services.tailscale.serve option broken:

• Tracked issue updated: tailscale/tailscale#18381 — Tailscale employee hwh33 acknowledged the bug (Apr 28) and confirmed internal tracking. This is part of a broader set of issues around declarative config for Services.
  Tailscale serve set-config registers services as http instead of https tailscale/tailscale#18381 (comment)

• Fix attempt: Contributor @Fryuni investigated the issue and attempted a fix around tls-terminated-tcp (Apr 28). No merged fix yet.

• Related new issue: tailscale/tailscale#19614 — FR to expose service capability flags (e.g. --accept-app-caps) in set-config file format (opened Apr 28). Suggests ongoing gaps in the declarative config approach.
  FR: Expose a way to define service capabilities in the tailscale serve set-config file tailscale/tailscale#19614

Suggested action: The services.tailscale.serve config in configs/nixos/default.nix remains disabled pending this fix. Upstream awareness is confirmed — consider revisiting when a fix ships.

Generated by .github/workflows/issue-monitor.yml.

[Fryuni]

You can use the package from my fork as a workaround. It is linked in the PR you referenced.

Fryuni/config-files@c1a938c

[github-actions]

Issue monitor found a new related issue:

• tailscale/tailscale#19724 — "serve config not reproducing cli" (reported 2026-06, labels: bug, services)
  This describes the same root problem: set-config does not reproduce the behavior of the CLI --https flag. The issue explicitly demonstrates that a service created via serve --https=443 localhost:5678 is stored by get-config and then fails when re-applied via set-config — matching the exact bug tracked here.
  serve config not reproducing cli tailscale/tailscale#19724

No merge has occurred yet on Fryuni's fix PR (#19554). The upstream issue (#18381) remains open with Tailscale tracking internally.

Generated by .github/workflows/issue-monitor.yml.

[github-actions]

Issue monitor update — no major changes since last report:

• tailscale/tailscale#19724 — Previously reported as a new related issue, now closed as duplicate of #18381. This confirms #18381 is the canonical tracker; no fix has shipped yet.
• tailscale/tailscale#18381 — Still open. No new substantive comments since the April 28 update from @hwh33 (who acknowledged it's tracked internally as part of a broader declarative config effort).
• Fryuni's fix PR (#19554) — Still open, unmerged.

Bottom line: the bug persists. The upstream team is aware and tracking it internally, but no ETA or fix has landed.

[github-actions]

Issue monitor — new related signals found

New nixpkgs issue: NixOS/nixpkgs#530174 — "services.tailscale.serve: cannot configure HTTPS (TLS termination), only plain HTTP/TCP"

• Filed 2026-06-28 by clarktsiory, confirms the same root bug from the nixpkgs module side
• The issue references a draft PR upstream: tailscale/tailscale#19207

Draft PR in tailscale repo: tailscale/tailscale#19207 — "nix: add nixos module for Tailscale"

• A WIP NixOS module proposal that includes service config as Nix config
• Last updated 2026-07-16 (after our last check)
• If merged, this could eventually replace or augment the nixpkgs services.tailscale.serve module

Suggested action: Watch tailscale/tailscale#19207 — if it lands with proper HTTPS support in its service config, it may become the preferred path for this flake.