htlin222/funnel-config
claude.symlink/skills/funnel-config/SKILL.md
Manage Tailscale Funnel routes for multi-service coexistence. Use when checking funnel status, adding/removing service routes, diagnosing tunnel connectivity, or when "funnel", "tailscale", "tunnel", "port routing" is mentioned. Also use proactively when deploying new services that need external HTTPS access.
$ install --global
skillsauthnpx skillsauth add htlin222/dotfiles funnel-configInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 5, 2026, 8:05 PM7.0s1 file scanned
SKILL.md
- name:
- funnel-config
- description:
- Manage Tailscale Funnel routes for multi-service coexistence. Use when checking funnel status, adding/removing service routes, diagnosing tunnel connectivity, or when "funnel", "tailscale", "tunnel", "port routing" is mentioned. Also use proactively when deploying new services that need external HTTPS access.
Tailscale Funnel Route Management
Discover Current State
# Get hostname
tailscale status --json | jq -r '.Self.DNSName' | sed 's/\.$//'
# List all routes
tailscale funnel status
# Check what's listening on which ports
lsof -i -P -n | grep LISTEN | grep -E ':(8080|3000|3030|5000)'
Add a Service Route
# Root path (only one service can own /)
tailscale funnel --bg <port>
# Sub-path (multiple can coexist)
tailscale serve --bg --set-path /<path> http://localhost:<port>
Rule: Routes coexist. Adding a root route does NOT remove sub-path routes. Adding a sub-path does NOT remove the root route.
Remove a Route
# Remove root
tailscale funnel --https=443 off
# Remove a sub-path
tailscale serve --https=443 --set-path /<path> off
Health Check
After any route change, verify both local and external:
HOSTNAME=$(tailscale status --json | jq -r '.Self.DNSName' | sed 's/\.$//')
# Local
curl -s --max-time 5 http://127.0.0.1:<port>/health
# External (proves funnel works end-to-end)
curl -s --max-time 10 "https://${HOSTNAME}/<path>" -o /dev/null -w "%{http_code}\n"
Troubleshooting
| Symptom | Cause | Fix |
|---------|-------|-----|
| External returns nothing | Funnel not active | tailscale funnel --bg <port> |
| External returns 502 | Service not running on that port | Start the service, check lsof -i :<port> |
| Route disappeared after restart | Funnel routes persist, but tailscale serve routes may not | Re-add with tailscale serve --bg --set-path ... |
| New route killed existing service | Won't happen — routes coexist | Verify with tailscale funnel status |
| GitHub webhooks not arriving | Hostname mismatch or funnel off | Check tailscale funnel status, compare with webhook URL |
Principles
- One service per path. Never route two services to the same path.
- Prefer sub-paths for non-primary services to avoid root conflicts.
- Always verify with external curl after changes — local success doesn't prove funnel works.
- Funnel requires Tailscale Funnel to be enabled on the tailnet (ACL policy).
Related Skills
htlin222/zettel
testing
VerifiedTrustedCommunity
Converts narrative medical text into Pocket Medicine bullet-style notes with proper abbreviations, then modularizes sections exceeding 20 lines into linked standalone files.
76SKILL.mdUpdated Apr 5, 2026
htlin222/vm-docker
devops
VerifiedTrustedCommunity
Use when deploying Docker services on the local VM (hostname: vm, Pop!_OS) with Traefik reverse proxy and Homepage dashboard. Covers crane image workflow, Traefik file-provider registration, Homepage services.yaml entries, and compose templates on the traefik-proxy network.
76SKILL.mdUpdated Apr 5, 2026
htlin222/visualization-check
development
VerifiedTrustedCommunity
Use when reviewing a data visualization or figure for clarity, checking if a graph communicates its message without additional context, or iterating on R/Python plot scripts until a naive reader can fully understand the figure.
76SKILL.mdUpdated Apr 5, 2026
htlin222/vale
development
VerifiedTrustedCommunity
Runs Vale prose linter on markdown/text files and auto-fixes issues. Use when the user asks to lint, proofread, or improve writing quality of markdown or text files.
76SKILL.mdUpdated Apr 5, 2026