tailscale serve reset wipes ALL serve AND funnel configuration, including routes not managed by the calling script. Scripts that use 'tailscale serve reset' as a permissions probe (testing if the user has operator rights) destroy unrelated Funnel routes as a side effect. Symptom: services previously accessible via Tailscale Funnel (public internet ingress) stop working for off-tailnet users, while on-tailnet access continues to work fine.
Replace 'tailscale serve reset' with 'tailscale serve status' as the permissions probe. 'tailscale serve status' is read-only — it fails with the same permission error when operator rights are missing, but does not modify any configuration. The per-port 'tailscale serve --bg --https=PORT' calls are already idempotent, so the blanket reset was never needed for correctness — only for the permissions side effect. After fixing the script, restore the wiped Funnel route with: tailscale funnel --bg --https=443 http://localhost:. No additional persistence setup is needed — tailscaled stores serve/funnel config and restores it on every boot.