all repos — nixfiles @ 938a283e87b72300a8414f50e06a87472bbda7bd

System and user configuration, managed by nix and home-manager

linde: enable app hosting with dynamic tailscale hostnames

Alan Pearce
commit

938a283e87b72300a8414f50e06a87472bbda7bd

parent

4dfbdcc45c40165186a0f87871321a0eb5b719e3

1 file changed, 8 insertions(+), 1 deletion(-)

changed files
M system/hosts/linde.nix → system/hosts/linde.nix
@@ -48,6 +48,7 @@ mode = "400";
         symlink = false;
       };
     acme.file = ../../secrets/acme.age;
+    caddy.file = ../../secrets/caddy.age;
     binarycache.file = ../../secrets/binarycache.age;
     powerdns.file = ../../secrets/powerdns.age;
     redis-website.file = ../../secrets/redis-website.age;

@@ -279,6 +280,7 @@ "--advertise-exit-node"
       "--ssh"
     ];
     useRoutingFeatures = "both";
+    permitCertUid = config.services.caddy.user;
   };
 
   services.mycal = {

@@ -563,12 +565,14 @@
   services.caddy = {
     enable = true;
     group = "caddy";
+    environmentFile = config.age.secrets.caddy.path;
     package = pkgs.nur.repos.xyenon.caddy.withPlugins {
       plugins = [
         "github.com/caddyserver/cache-handler@v0.16.0"
         "github.com/mholt/caddy-l4@v0.0.0-20251111042133-1823cde2603c"
+        "github.com/tailscale/caddy-tailscale@v0.0.0-20251117033914-662ef34c64b1"
       ];
-      hash = "sha256-lshM7iq7r+wY0ChtUc3FOHFXWweUM+hU6wBjFiokl+c=";
+      hash = "sha256-LM9Mxr6owZElcl7csX9WVl6mWLEvIDMRbSgyrJ+pI9s=";
     };
     globalConfig = ''
       cache

@@ -587,6 +591,9 @@ route
           }
           tls
         }
+      }
+      tailscale {
+        tags tag:app
       }
     '';
     virtualHosts =