Distillation

Date: June 11, 2026

• 🟡 (22:06) User fetched correct Tailscale Services configuration file doc (tailscale.com/docs/reference → "Tailscale Services configuration file", last validated Jan 27, 2026)
• 🟡 (22:06) Tailscale Services config file format confirmed: top-level fields version (must be "0.0.1") and services (object); service names use format svc:<service-name>; each service has endpoints (required, object) and advertised (optional boolean, defaults true)
• 🟡 (22:06) Endpoint mapping format: "<protocol>:<port|port-range>": "<local-target>" — only tcp protocol supported for incoming; local-target uses URI format <protocol>://<host:port> where protocol is http, https, or tcp
• 🟡 (22:06) Example from doc: "tcp:443": "https://localhost:443" under service svc:web-server, version "0.0.1"
• 🟡 (22:06) Assistant noted doc covers serve config file format only — does NOT cover policy-file auto-approver syntax
• 🟡 (22:06) Assistant identified two separate requirements for Tailscale Services: (1) Service resource created in admin console (Services → Create) — allocates VIP 100.100.30.73 ✓ confirmed working; (2) host node advertises AND is approved/auto-approved to host it — this step is failing
• 🟡 (22:06) Assistant hypothesis: Self.AdvertisedServices stays None after healthy /vip-services exchange because control received advertisement but host is not approved — auto-approval for Services may live under service resource's host configuration in admin console, not necessarily autoApprovers ACL block
• 🟡 (22:06) Assistant next action: check Tailscale Services feature doc for where host approval/auto-approval is configured