code: func NewTLSServer(cfg TLSServerConfig) (*TLSServer, error) {
  	if err := cfg.CheckAndSetDefaults(); err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// limiter limits requests by frequency and amount of simultaneous
  	// connections per client
  	limiter, err := limiter.NewLimiter(cfg.LimiterConfig)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	fwd, err := NewForwarder(cfg.ForwarderConfig)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// authMiddleware authenticates request assuming TLS client authentication
  	// adds authentication information to the context
  	// and passes it to the API server
  	authMiddleware := &auth.AuthMiddleware{
  		AccessPoint:   cfg.AccessPoint,
  		AcceptedUsage: []string{teleport.UsageKubeOnly},
  	}
  	authMiddleware.Wrap(fwd)
  	// Wrap sets the next middleware in chain to the authMiddleware
  	limiter.WrapHandle(authMiddleware)
  	// force client auth if given
  	cfg.TLS.ClientAuth = tls.VerifyClientCertIfGiven
  
  	server := &TLSServer{
  		TLSServerConfig: cfg,
  		Server: &http.Server{
  			Handler: limiter,
  		},
  	}
  	server.TLS.GetConfigForClient = server.GetConfigForClient
  	return server, nil
  }
docs: // NewTLSServer returns new unstarted TLS server