all repos — nixfiles @ 938a283e87b72300a8414f50e06a87472bbda7bd

System and user configuration, managed by nix and home-manager

linde: enable app hosting with dynamic tailscale hostnames

Alan Pearce
commit

938a283e87b72300a8414f50e06a87472bbda7bd

parent

4dfbdcc45c40165186a0f87871321a0eb5b719e3

3 files changed, 16 insertions(+), 1 deletion(-)

changed files
A secrets/caddy.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 cvV2sw BEd/fty8y3hq+fNQgTevqKzvuGfWa46qRInCUwnI6CY
+VPPUw9FqGJxjjz4+rBZnUMD64LSodl2jQZ2QAer1/Tg
+-> piv-p256 VBDKjg AgA2y6cQr3EddL4RVxjm21OgCuoMaVrB0AiwC+jQoDrc
+fi54UWmqVmyJ7SII2SKRsHoR48pXZMFvA7WG+l8qXDw
+--- pnbdeRUtNFVq9gjl4iMyyAI8n6byr5V6SM5wnoRW7DA
+$
9&h&sčʼdzΐpyk+-2TQE
=F5,[jDQ/_ӳ:қ5sȑ)c!G^
M secrets/secrets.nix → secrets/secrets.nix
@@ -18,6 +18,7 @@ ];
 
     redis-website = [ linde ];
 
+    caddy = [ linde ];
     rauthy = [ linde ];
     binarycache = [ linde ];
     forgejo-actions-runner = [ linde ];
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -48,6 +48,7 @@ mode = "400";
         symlink = false;
       };
     acme.file = ../../secrets/acme.age;
+    caddy.file = ../../secrets/caddy.age;
     binarycache.file = ../../secrets/binarycache.age;
     powerdns.file = ../../secrets/powerdns.age;
     redis-website.file = ../../secrets/redis-website.age;

@@ -279,6 +280,7 @@ "--advertise-exit-node"
       "--ssh"
     ];
     useRoutingFeatures = "both";
+    permitCertUid = config.services.caddy.user;
   };
 
   services.mycal = {

@@ -563,12 +565,14 @@
   services.caddy = {
     enable = true;
     group = "caddy";
+    environmentFile = config.age.secrets.caddy.path;
     package = pkgs.nur.repos.xyenon.caddy.withPlugins {
       plugins = [
         "github.com/caddyserver/cache-handler@v0.16.0"
         "github.com/mholt/caddy-l4@v0.0.0-20251111042133-1823cde2603c"
+        "github.com/tailscale/caddy-tailscale@v0.0.0-20251117033914-662ef34c64b1"
       ];
-      hash = "sha256-lshM7iq7r+wY0ChtUc3FOHFXWweUM+hU6wBjFiokl+c=";
+      hash = "sha256-LM9Mxr6owZElcl7csX9WVl6mWLEvIDMRbSgyrJ+pI9s=";
     };
     globalConfig = ''
       cache

@@ -587,6 +591,9 @@ route
           }
           tls
         }
+      }
+      tailscale {
+        tags tag:app
       }
     '';
     virtualHosts =