Feature request: Tailscale Funnel support

We're self-hosting Headscale as a privacy-motivated alternative to the proprietary Tailscale coordination server, using the official Tailscale apps against our own server.

We initially evaluated NetBird as an alternative as well, but hit an (apparently known, unresolved) upstream bug where the iOS client completes the WireGuard handshake but never actually passes data through the tunnel (control plane fine, data plane empty). Switching the very same setup over to a self-hosted Headscale server instead fixed that completely — SSH connectivity from iOS worked flawlessly, no reconfiguration needed on our side beyond pointing the client at our Headscale URL. We were genuinely happy with the result.

Unfortunately, we then had to revert back to the original proprietary tailscale.com control server anyway, because we depend on Tailscale Funnel for exposing a self-hosted service (Home Assistant) to the public internet with a valid TLS certificate, and Headscale does not support Funnel (we found the older related discussion in #1040, which is closed).

Could Funnel support be reconsidered/prioritized? For us it's the single remaining blocker preventing a full switch away from the proprietary control server — everything else (basic connectivity, SSH, DERP, ACLs) has worked well in our testing.

Happy to help test if there's ever a branch/experimental build with partial Funnel support.