code: func NewPublicListener(svc *connect.Service, cfg PublicListenerConfig,
  	logger *log.Logger) *Listener {
  	bindAddr := fmt.Sprintf("%s:%d", cfg.BindAddress, cfg.BindPort)
  	return &Listener{
  		Service: svc,
  		listenFunc: func() (net.Listener, error) {
  			return tls.Listen("tcp", bindAddr, svc.ServerTLSConfig())
  		},
  		dialFunc: func() (net.Conn, error) {
  			return net.DialTimeout("tcp", cfg.LocalServiceAddress,
  				time.Duration(cfg.LocalConnectTimeoutMs)*time.Millisecond)
  		},
  		bindAddr:      bindAddr,
  		stopChan:      make(chan struct{}),
  		listeningChan: make(chan struct{}),
  		logger:        logger,
  		metricPrefix:  publicListenerMetricPrefix,
  		// For now we only label ourselves as source - we could fetch the src
  		// service from cert on each connection and label metrics differently but it
  		// significaly complicates the active connection tracking here and it's not
  		// clear that it's very valuable - on aggregate looking at all _outbound_
  		// connections across all proxies gets you a full picture of src->dst
  		// traffic. We might expand this later for better debugging of which clients
  		// are abusing a particular service instance but we'll see how valuable that
  		// seems for the extra complication of tracking many gauges here.
  		metricLabels: []metrics.Label{{Name: "dst", Value: svc.Name()}},
  	}
  }
docs: // NewPublicListener returns a Listener setup to listen for public mTLS
  // connections and proxy them to the configured local application over TCP.