I learned this from hosting SmallStep CA behind Traefik. You can use TCP mode for specific subdomains and match it using HostSNI. Then if the client uses SNI it

I learned this from hosting SmallStep CA behind Traefik. You can use TCP mode for specific subdomains and match it using HostSNI. Then if the client uses SNI it should work. So you can use both TCP and HTTP routers on the same port. https://github.com/Janhouse/tailscaled-derper/blob/main/docker-compose.yml#L31-L36 https://github.com/Janhouse/tailscaled-derper/blob/main/dock... Since we use TLS passthrough and Traefik just proxies TCP, you have to pass certificates to derper, so you either use the Traefik certificate extractor or some other tool to get them. And initially I though that I would have to integrate libproxyproto into derper in order to handle client IP addresses correctly behind Traefik but it looks like it doesn't really need it.