apiVersion: v1
kind: ConfigMap
metadata:
  name: tailscale-serve
  namespace: tailscale
data:
  # Plain TCP forwarding: TLS passes through untouched and ends at Traefik.
  serve.json: |
    {
      "TCP": {
        "80": {"TCPForward": "traefik.kube-system.svc.cluster.local:80"},
        "443": {"TCPForward": "traefik.kube-system.svc.cluster.local:443"}
      }
    }