# New installations should use guided setup, which infers the node owner's
# trusted login and appends a separate boot-time user-instance patch after
# confirmation:
#   dsh plugin --profile web exec dsh-tailscale-gateway-setup
# This boot-time baseline template remains useful for manual configuration or
# existing installations. It requires DSH to load/reload its profile; guided
# setup is the normal two-action path for an already-running DSH process.
#
# The gateway listener is intentionally fixed at 127.0.0.1:3088 and forwards
# only to the local DSH Web server at 127.0.0.1:3080. Do not add listener or
# upstream settings: the bundle rejects them to prevent accidental exposure.
- id: dsh-tailscale-gateway
  config:
    enabled: true
    # Use the exact external URL configured with `tailscale serve`, including
    # the port when it is not the default HTTPS port.
    publicOrigin: 'https://your-device.your-tailnet.ts.net:8443'

    # Exact values of Tailscale-User-Login permitted to use DSH. These must be
    # the Tailscale identities, usually the user's login/email address, and are
    # case-sensitive. This allowlist authorizes use even when Tailnet ACLs or
    # grants are absent; an allowlisted user is a full DSH administrator.
    trustedLogins:
      - 'replace-with-an-exact-tailscale-login@example.invalid'

    # First-time setup uses ensure mode. After this sidecar successfully binds,
    # it creates only this exact absent private Serve route; conflicts are never
    # overwritten. Use mode: manual only if you want to own Serve yourself.
    tailscaleServe:
      mode: ensure