feat(tailscale-nginx-auth): protect reverse proxied services behind tailscale authentication

modules/nixos/features/bazarr.nix

@@ -19,6 +19,19 @@ in
     ];
 
     caddy.virtualHosts."bazarr.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/copyparty.nix

@@ -35,6 +35,19 @@ in
     };
 
     caddy.virtualHosts."copyparty.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/couchdb.nix

@@ -36,6 +36,19 @@ in
     };
 
     caddy.virtualHosts."couchdb.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/homepage-dashboard.nix

@@ -378,6 +378,19 @@ in
     };
 
     caddy.virtualHosts."homepage-dashboard.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/immich.nix

@@ -20,6 +20,19 @@ in
     ];
 
     caddy.virtualHosts."immich.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/jellyfin.nix

@@ -18,6 +18,19 @@ in
     ];
 
     caddy.virtualHosts."jellyfin.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/karakeep.nix

@@ -20,6 +20,19 @@ in
     ];
 
     caddy.virtualHosts."karakeep.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/kavita.nix

@@ -23,6 +23,19 @@ in
     ];
 
     caddy.virtualHosts."kavita.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/lidarr.nix

@@ -21,6 +21,19 @@ in
     ];
 
     caddy.virtualHosts."lidarr.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/miniflux.nix

@@ -27,6 +27,19 @@ in
     ];
 
     caddy.virtualHosts."miniflux.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/ntfy-sh.nix

@@ -14,6 +14,19 @@ in
     };
 
     caddy.virtualHosts."ntfy-sh.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/nzbget.nix

@@ -18,6 +18,19 @@ in
     };
 
     caddy.virtualHosts."nzbget.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/paperless.nix

@@ -31,6 +31,19 @@ in
     };
 
     caddy.virtualHosts."paperless.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/prowlarr.nix

@@ -20,6 +20,19 @@ in
     ];
 
     caddy.virtualHosts."prowlarr.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/qbittorrent.nix

@@ -15,6 +15,19 @@ in
     };
 
     caddy.virtualHosts."qbittorrent.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/qui.nix

@@ -31,6 +31,19 @@ in
   ];
 
   services.caddy.virtualHosts."qui.fi33.buzz".extraConfig = ''
+    forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+      uri /auth
+      header_up Remote-Addr {remote_host}
+      header_up Remote-Port {remote_port}
+      header_up Original-URI {uri}
+      copy_headers {
+        Tailscale-User>X-Webauth-User
+        Tailscale-Name>X-Webauth-Name
+        Tailscale-Login>X-Webauth-Login
+        Tailscale-Tailnet>X-Webauth-Tailnet
+        Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+      }
+    }
     reverse_proxy localhost:${toString port}
     tls ${certloc}/cert.pem ${certloc}/key.pem {
       protocols tls1.3

modules/nixos/features/radarr.nix

@@ -21,6 +21,19 @@ in
     ];
 
     caddy.virtualHosts."radarr.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/radicale.nix

@@ -29,6 +29,19 @@ in
     };
 
     caddy.virtualHosts."radicale.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/readarr.nix

@@ -21,6 +21,19 @@ in
     ];
 
     caddy.virtualHosts."readarr.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/sonarr.nix

@@ -21,6 +21,19 @@ in
     ];
 
     caddy.virtualHosts."sonarr.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/syncthing.nix

@@ -68,6 +68,19 @@ in
         null;
 
     caddy.virtualHosts."syncthing.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy http://localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3

modules/nixos/features/tailscale.nix

@@ -1,8 +1,15 @@
 {
-  services.tailscale = {
+  services = {
+    tailscale = {
       enable = true;
       extraSetFlags = [
         "--accept-dns=true"
       ];
     };
+    tailscaleAuth = {
+      enable = true;
+      user = "caddy";
+      group = "caddy";
+    };
+  };
 }

modules/nixos/features/upbank2firefly.nix

@@ -50,6 +50,19 @@ in
   };
 
   services.caddy.virtualHosts."upbank2firefly.fi33.buzz".extraConfig = ''
+    forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+      uri /auth
+      header_up Remote-Addr {remote_host}
+      header_up Remote-Port {remote_port}
+      header_up Original-URI {uri}
+      copy_headers {
+        Tailscale-User>X-Webauth-User
+        Tailscale-Name>X-Webauth-Name
+        Tailscale-Login>X-Webauth-Login
+        Tailscale-Tailnet>X-Webauth-Tailnet
+        Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+      }
+    }
     reverse_proxy localhost:${toString port}
     tls ${certloc}/cert.pem ${certloc}/key.pem {
       protocols tls1.3

modules/nixos/features/vaultwarden.nix

@@ -31,6 +31,19 @@ in
     ];
 
     caddy.virtualHosts."vaultwarden.fi33.buzz".extraConfig = ''
+      forward_auth unix//run/tailscale-nginx-auth/tailscale-nginx-auth.sock {
+        uri /auth
+        header_up Remote-Addr {remote_host}
+        header_up Remote-Port {remote_port}
+        header_up Original-URI {uri}
+        copy_headers {
+          Tailscale-User>X-Webauth-User
+          Tailscale-Name>X-Webauth-Name
+          Tailscale-Login>X-Webauth-Login
+          Tailscale-Tailnet>X-Webauth-Tailnet
+          Tailscale-Profile-Picture>X-Webauth-Profile-Picture
+        }
+      }
       reverse_proxy localhost:${toString port}
       tls ${certloc}/cert.pem ${certloc}/key.pem {
         protocols tls1.3