code: func (process *TeleportProcess) initProxy() error {
  	// if no TLS key was provided for the web UI, generate a self signed cert
  	if process.Config.Proxy.TLSKey == "" && !process.Config.Proxy.DisableTLS && !process.Config.Proxy.DisableWebService {
  		err := initSelfSignedHTTPSCert(process.Config)
  		if err != nil {
  			return trace.Wrap(err)
  		}
  	}
  	process.registerWithAuthServer(teleport.RoleProxy, ProxyIdentityEvent)
  	process.RegisterCriticalFunc("proxy.init", func() error {
  		eventsC := make(chan Event)
  		process.WaitForEvent(process.ExitContext(), ProxyIdentityEvent, eventsC)
  
  		var event Event
  		select {
  		case event = <-eventsC:
  			process.Debugf("Received event %q.", event.Name)
  		case <-process.ExitContext().Done():
  			process.Debugf("Process is exiting.")
  			return nil
  		}
  
  		conn, ok := (event.Payload).(*Connector)
  		if !ok {
  			return trace.BadParameter("unsupported connector type: %T", event.Payload)
  		}
  
  		err := process.initProxyEndpoint(conn)
  		if err != nil {
  			return trace.Wrap(err)
  		}
  
  		return nil
  	})
  	return nil
  }
docs: // initProxy gets called if teleport runs with 'proxy' role enabled.
  // this means it will do two things:
  //    1. serve a web UI
  //    2. proxy SSH connections to nodes running with 'node' role
  //    3. take care of reverse tunnels