http:
  routers:
    tsproxy:
      entryPoints:
      - websecure
      service: ts-svc
      rule: Host(`ts.over.rest`)
  services:
    ts-svc:
      loadBalancer:
        servers:
          - url: https://controlplane.tailscale.com
        passHostHeader: false