[bradfitz]

Our Funnel ingress servers won't proxy any TCP connection that doesn't have a *.ts.net SNI name currently.

But BYODomain is something that'd be fun to add.

[pbronez]

BYODomain would be great. This would give me a secure & reliable to host public services out of my homelab.

[anderspitman]

It would be great if Tailscale adds this, but there are lots of services that provide this functionality if you need it today, including Cloudflare Tunnel.

[xyzzy_plugh]

Cloudflare's CNAME flattening with proxy enabled would do the trick. The ingress sees a request to the CNAME target so SNI works as usual.