Binds to the tailscale IP only, with PAM auth over TLS. TLS cert/key are machine-local secrets and intentionally not tracked.