Fix TLS termination for private TCP services

[marvinvr]

What changed

• pass --tls-terminated-tcp when a private service requests TLS-terminated TCP
• parse Tailscale's TerminateTLS status field so reconciliation preserves the protocol instead of treating it as plain TCP
• add an E2E service that verifies the live TLS-terminated status and remains stable across reconciliation cycles
• clarify the protocol behavior in the canonical reference documentation

Why

Private services currently collapse tls-terminated-tcp into --tcp, silently exposing a plaintext TCP listener. Merely changing the creation flag is insufficient because the status parser would still read the resulting endpoint as plain TCP and reapply it on every reconciliation cycle.

This restores the documented behavior: Tailscale terminates incoming TLS and forwards decrypted TCP to the configured backend.

Closes #71.

Validation

• bash -n e2e.sh
• E2E coverage now asserts the live TerminateTLS field and checks stability across at least three reconciliation cycles
• full build, unit, lint, Docker, and E2E validation delegated to this PR's GitHub Actions pipeline

Summary by CodeRabbit

• New Features

  • Added support for TLS-terminated TCP services.
  • Incoming TLS connections can now be terminated at the edge and forwarded as decrypted TCP traffic to the backend.
  • TLS-terminated TCP services are correctly identified and configured with their dedicated protocol.
  • Added end-to-end coverage for protocol detection, service reconciliation, and idempotency.

• Documentation

  • Clarified how TLS termination and backend forwarding work for supported TCP services.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 89cd3f13-4e99-4e68-9560-0567f7271a43

📥 Commits

Reviewing files that changed from the base of the PR and between d8c4ca1 and 2e15a86.

📒 Files selected for processing (6)

• docker-compose.e2e.yaml
• docs/07-reference.md
• e2e.sh
• tailscale/client.go
• tailscale/service.go
• tailscale/service_test.go

---

📝 Walkthrough

Walkthrough

Changes

TLS-terminated TCP support

Layer / File(s)	Summary
TLS termination configuration parsing tailscale/client.go, tailscale/service_test.go	TailscaleTCPConfig now parses TerminateTLS. Tests verify the TLS hostname and forwarded backend destination.
Protocol classification and CLI mapping tailscale/service.go, tailscale/service_test.go	TLS-terminated TCP is classified separately from plain TCP. Service creation uses --tls-terminated-tcp.
End-to-end reconciliation coverage docker-compose.e2e.yaml, e2e.sh, docs/07-reference.md	E2E tests cover protocol detection, idempotency, and reconciliation stability for port 6697. The reference documentation describes TLS termination and TCP forwarding.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• marvinvr/docktail#22: Introduced related E2E fixtures, scripts, and service tests.
• marvinvr/docktail#46: Shared TLS-terminated TCP coverage in service tests and E2E configuration.
• marvinvr/docktail#57: Related TCP parsing and reconciliation changes using TerminateTLS and TCPForward.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/fix-tls-terminated-service

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}