Function daemon_tcp_services 

pub fn daemon_tcp_services(config: &Config) -> Vec<TcpService>

Resolve the daemon’s enabled self-TLS listeners from live config.

Enrollment is only listed when the daemon actually runs it: alongside WSS (it refuses to start without [wss]) and not under a bring-your-own client CA, where it holds no signing key and parks the endpoint. A bind address that does not parse as an IP is skipped: the listener itself refuses such a bind, so there is nothing to forward to.