blumeops/ansible/roles/tailscale_serve/tasks/main.yml

---
- name: Get current tailscale serve status
  ansible.builtin.command: tailscale serve status --json
  register: tailscale_serve_status
  changed_when: false

- name: Parse serve status
  ansible.builtin.set_fact:
    tailscale_serve_config: "{{ ((tailscale_serve_status.stdout | default('{}', true)) | from_json).Services | default({}) }}"

# Configure HTTPS if service doesn't have Web config yet
- name: Configure HTTPS services
  ansible.builtin.command: >
    tailscale serve --service="{{ item.name }}"
    --https={{ item.https.port }} {{ item.https.upstream }}
  loop: "{{ tailscale_serve_services }}"
  when:
    - item.https is defined
    - tailscale_serve_config[item.name] is not defined or tailscale_serve_config[item.name].Web is not defined
  register: tailscale_serve_https_result
  changed_when: true
  failed_when: false

# Configure TCP if service doesn't have the specific port configured yet
- name: Configure TCP services
  ansible.builtin.command: >
    tailscale serve --service="{{ item.name }}"
    --tcp={{ item.tcp.port }} {{ item.tcp.upstream }}
  loop: "{{ tailscale_serve_services }}"
  when:
    - item.tcp is defined
    - tailscale_serve_config[item.name] is not defined or
      tailscale_serve_config[item.name].TCP is not defined or
      tailscale_serve_config[item.name].TCP[item.tcp.port | string] is not defined or
      tailscale_serve_config[item.name].TCP[item.tcp.port | string].TCPForward is not defined
  register: tailscale_serve_tcp_result
  changed_when: true
  failed_when: false