Proxy API

Server-level proxy state: certificates, upstream policy, TCP/UDP ports and tailnet

Deploy the server-level proxy configuration

Sends a proxy_configure command with the desired certificates, upstream policy and tailnet. The result updates the applied state asynchronously.

Preview what deploying the proxy would change

Lists the staged differences, whether the proxy container is recreated and warnings (a tailnet node is created, replaced or deleted, a port another process holds, HTTP-01 certificates that cannot validate off port 80). ports plans the deploy as if that proxy ports setting were staged too, without staging it (0 = the agent's own port).

The effective route table of the server's proxy (read-only)

Hostnames, upstreams and policies as the proxy receives them. Basic-auth users and hashes are never included.

Stage upstream policy and tailnet settings

Needs proxy:write; the loopback and link-local toggles need admin; the proxy ports can only be changed by the instance administrator (403 instance_admin_required; 422 invalid_proxy_ports, proxy_port_clash, agent_too_old). Changes are staged until POST /servers/{id}/proxy/deploy, which recreates the proxy container when a port changes. A managed tailnet needs the Tailscale integration (422 tailnet_not_configured); host mode needs Tailscale detected on the host (422 host_tailscale_not_detected).

Re-provision the managed tailnet node

Deletes the node's state, registers it again with a fresh single-use key and removes the old device from the tailnet. Use it when the device was removed in the Tailscale admin console.