@@ -740,9 +740,15 @@ extraConfig = ''
             reverse_proxy ${config.services.ntfy-sh.settings.listen-http}
           '';
         };
-        "read.${domain}" = {
+        "read.${ts-domain}" = {
           extraConfig = ''
-            reverse_proxy localhost:${toString config.services.readeck.settings.server.port}
+            bind tailscale/read
+            tailscale_auth
+            reverse_proxy {
+              to unix//run/web/readeck.sock
+              header_up X-Webauth-User {http.auth.user.tailscale_login}
+              header_up X-Webauth-Email {http.auth.user.tailscale_user}
+            }
           '';
         };
         "papers.${ts-domain}" = {
@@ -896,20 +902,58 @@ TRUST_PROXY = true;
     };
   };
 
+  users.groups.webservice = {
+    members = [
+      "caddy"
+    ];
+  };
+  systemd.tmpfiles.rules = [
+    # setgid bit (2)
+    # sticky bit (4)
+    "d /run/web/ 6770 caddy webservice -"
+  ];
+  systemd.services.caddy.serviceConfig = {
+    ReadWritePaths = [ "/run/web" ];
+  };
+  systemd.services.readeck.serviceConfig = {
+    SupplementaryGroups = [ "webservice" ];
+  };
+
   services.readeck = {
     enable = true;
+    package = pkgs.readeck.overrideAttrs (attrs: rec {
+      version = "0.22.0-pre1";
+      src = pkgs.fetchFromCodeberg {
+        owner = "readeck";
+        repo = "readeck";
+        rev = "12e39b6fe20d3949b249b1410b83ea8ea5043046";
+        hash = "sha256-QOnxTUlC+TaU/MSDSIg8T3cc7dScojVGVyM7kltljbA=";
+      };
+
+      vendorHash = "sha256-2MB7v5oG/LcEKtgbFNxPXSI8TljpbqYUrI7pvu7m+e8=";
+
+      npmDeps = pkgs.fetchNpmDeps {
+        src = "${src}/web";
+        hash = "sha256-znUKRaUdx6GXD2YL6hs0iveaAAHQ8H9n4NHZFi331+g=";
+      };
+    });
     environmentFile = config.age.secrets.readeck.path;
     settings = {
       server = {
-        host = "::1";
-        port = 8000;
-        base_url = "https://read.alin.ovh";
+        host = "unix:/run/web/readeck.sock?mode=0660";
+        base_url = "https://read.${ts-domain}";
       };
       email = {
         host = "localhost";
         port = 587;
         from = "readeck@${domain}";
         from_noreply = "noreply+readeck@${domain}";
+      };
+      auth.forwarded = {
+        enabled = true;
+        provisioning = false;
+        header_user = "X-Webauth-User";
+        header_email = "X-Webauth-Email";
       };
     };
   };