cmd/tailscale/cli: funnel help issues

[bradfitz]

at e995641,

$ tailscale funnel
USAGE
  funnel <target>
  funnel status [--json]
  funnel reset

Funnel enables you to share a local server on the internet using Tailscale.

To share only within your tailnet, use `tailscale serve`

<target> can be a file, directory, text, or most commonly the location to a service running on the
local machine. The location to the location service can be expressed as a port number (e.g., 3000),
a partial URL (e.g., localhost:3000), or a full URL including a path (e.g., http://localhost:3000/foo).

EXAMPLES
  - Expose an HTTP server running at 127.0.0.1:3000 in the foreground:
    $ tailscale funnel 3000

  - Expose an HTTP server running at 127.0.0.1:3000 in the background:
    $ tailscale funnel --bg 3000

  - Expose an HTTPS server with a valid certificate at https://localhost:8443
    $ tailscale %!s(MISSING) https://localhost:8443

^^^^ %!s(MISSING) here

  - Expose an HTTPS server with invalid or self-signed certificates at https://localhost:8443
    $ tailscale %!s(MISSING) https+insecure://localhost:8443

... and here ^^^

For more examples and use cases visit our docs site https://tailscale.com/kb/1247/funnel-serve-use-cases

SUBCOMMANDS
  status  view current proxy configuration
  reset   reset current serve/funnel config

FLAGS
  --bg, --bg=false
        Run the command as a background process (default false)
  --http string
        Expose an HTTP server at the specified port

Why's this of type string if it's just a port?

  --https string
        Expose an HTTPS server at the specified port (default

^^^ missing closing paren

  --set-path string
        Appends the specified path to the base URL for accessing the underlying service
  --tcp string
        Expose a TCP forwarder to forward raw TCP packets at the specified port
  --tls-terminated-tcp string
        Expose a TCP forwarder to forward TLS-terminated TCP packets at the specified port

Similarily, why strings if these only take ports?

[bradfitz]

And I tried this out of habit,

$ tailscale funnel off
error: failed to remove web serve: error: handler does not exist

try `tailscale serve --help` for usage info

Weird "handler does not exist" error message. And I ran "funnel" but it suggests trying "tailscale serve --help" instead of "funnel --help".

[bradfitz]

"forward raw TCP packets" is misleading ... it's not packet-level like a subnet router on Linux. It proxies, terminating TCP inside tailscaled and making a new TCP connection outbound.

[bradfitz]

Oh, off is actually a subcommand? It's not documented. Now that I've done funnel reset, it works. Not sure how it got into that broken state above.

[bradfitz]

"Expose an HTTPS server with a valid certificate at https://localhost:8443"

That's impossible: you can't get a cert for "localhost", so that'll never be a valid option?

[samlinville]

"Expose an HTTPS server with a valid certificate at https://localhost:8443"

That's impossible: you can't get a cert for "localhost", so that'll never be a valid option?

@bradfitz https://tailscale.com/kb/1242/tailscale-serve/#using-a-valid-certificate This is what we're trying to reference, is there a better way to say this? Or is the KB incorrect

[bradfitz]

The KB seems incorrect to me. @shayne, what did you mean to write there? (from https://github.com/tailscale/tailscale-www/commit/3fb35047a)

[tylersmalley]

I have a PR to fix the templating issue referenced in the description.

$ tailscale funnel off

I don't believe this was previously valid, as it required the serve port. That aside, we have a PR to provide the translation to folks using the legacy command as well as some improvements to off just landed.

off is actually a subcommand

It's not a subcommand, but it can appear that way with how it's used. We allow you to omit the target with off, and when you do that it ends up being the first argument.

tailscale serve 3000 off

# or 

tailscale serve off

"forward raw TCP packets" is misleading ... it's not packet-level like a subnet router on Linux. It proxies, terminating TCP inside tailscaled and making a new TCP connection outbound.

Have a suggestion for the wording? Should dropping the word "raw" suffice?

[shayne]

That's impossible: you can't get a cert for "localhost", so that'll never be a valid option?

Not entirely true. Many people use projects like https://github.com/FiloSottile/mkcert so that https://localhost could be a thing.

That said, most backends will be http. If it happens to be an https backend, it's more likely to be an invalid cert (such that https+insecure should've been used).

Expose an HTTPS server with a valid certificate at localhost:8443

This description is tricky because we currently only allow localhost as a backend. We should explain HTTPS backends better on the KB.

$ tailscale funnel off

This was previously $ tailscale funnel 443 off

[bradfitz]

Documenting mkcert and/or https+insecure SGTM.