How do we get the previous functionality back? I'd prefer to keep forwarding the real path to my local service, when I use funnel.

Sorry, you're having trouble. It's a tricky decision, but we decided it's better not to leak the mount-point to the backend. Imagine the case where you mount the same app at two different mount points or if you're using a project that doesn't support the path prefix.

There are a couple of options. You can use / as your mount point. This setup will forward all paths to your reverse proxy.

You could also set up Caddy (or similar) and use our TCP forwarding features to have complete control over web requests.

Could you add support for adding an optional path to the <source>?

That way I could do something similar to the following, and still support it:

tailscale serve https:443 / http://127.0.0.1:3000
tailscale serve https:443 /api/v1/graphql http://127.0.0.1:4000/api/v1/graphql

It's explicit that I want this behaviour for the second backend, as it's expecting that path to be hit.

Edit: Updated the first port, as I had copied the wrong line.

The second backend also listens on 127.0.0.1:4000, in which case the first serve command would satisfy all paths.

My bad, I meant to write :3000 for the first one. Bad copypaste.

OK, thanks. I'll take a look at what it would look like and take it into consideration. Thanks for reaching out!

Thanks a lot @shayne - It would be super beneficial to our team at least.

Do let me know if you want an alpha tester or 7! 🚀

Will do, In the meantime, definitely consider wiring up Caddy via:

$ tailscale serve tls-terminated-tcp:443 tcp://localhost:80

Slightly off-topic, hope it's okay.

Do you know why my colleague can access his own funnel from his own machine (tls on port 443), and I can't access my own?
It worked at some point prior to rebooting my own machine, but no longer. Nothing binds to 443 on my machine, but IPNExtension does on his.

Edit: He's on an mac M1, and I'm on mac i9, if it matters.

I worked on this at #6930

macOS sandbox can be annoying. We should move specifics onto that issue. I'm curious if macOS versions are the same and if you can bind any other process to 443, even netcat.

@Multiply see #7743

@shayne thanks for working on this so quickly! 🚀

Just waiting for my app store to show the update, and I'll try it out. ⌛

Sure thing! We also have builds available on our packages server:
https://pkgs.tailscale.com/stable/#macos

Sorry to reopen this, but I'm wondering whether this works the way I think it is working.

I have a service running at localhost:3080. When I do sudo tailscale serve --bg --set-path /path 3080, I get 404 errors when I go to my-tailnet.ts.net/path, but when i do sudo tailscale serve --bg 3080 and go to my-tailnet.ts.net, everything works fine.

My understanding is that after this change, the /path part is removed silently from the URL when being passed to the app. Is this a misunderstanding of how this works? How can I achieve this functionality?

Thanks!