zidane 9.0.3 → 9.0.4

package/docs/SERVER.md

@@ -884,6 +884,14 @@ Tailscale keeps the server private to your devices, with a certificate on
 tailscale serve --bg --https=443 http://127.0.0.1:4280
 ```
 
+If another program on the computer already listens on port 443 (a reverse
+proxy such as Traefik), `tailscale serve` on 443 takes that port for tailnet
+traffic and breaks the proxy. Setup reads the ports in use. If 443 is in
+use, setup uses 8443 (then 4443, then 10443) and tells you why. Clients then
+connect to `wss://<machine>.<tailnet>.ts.net:8443`. To choose the port, pass
+`--tailscale-port <n>`. When you run setup again, it keeps the earlier port
+while that port is free.
+
 Cloudflare Tunnel makes the server public: anyone can reach its login.
 Setup then sets `exposure: public` ([Exposure](#exposure)) and gives tokens
 an expiry. It creates a locally managed tunnel (`cloudflared tunnel login`,
@@ -927,6 +935,10 @@ WebSocket upgrade too. With channels off, it answers only `/healthz`.
 tailscale funnel --bg --https=8443 http://127.0.0.1:4281   # or a cloudflared host name to :4281
 ```
 
+Funnel works only on ports 443, 8443 and 10000. Setup uses the first of
+8443, 10000 and 443 that is free on the computer and that clients do not
+use. If none of them is free, setup stops and tells you what to change.
+
 A leaked token is then of no use outside your tailnet. `zidane server
 doctor` makes sure that the public address refuses WebSocket clients.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zidane",
-  "version": "9.0.3",
+  "version": "9.0.4",
   "description": "an agent that goes straight to the goal",
   "type": "module",
   "private": false,