tower: open caddy ports on tailnet

1 files changed, 6 insertions, 1 deletions

diff --git a/hosts/tower/web/caddy.nix b/hosts/tower/web/caddy.nix
index 5efdbc3..2bead84 100644
--- a/hosts/tower/web/caddy.nix
+++ b/hosts/tower/web/caddy.nix
@@ -8,6 +8,7 @@
 let
   cfg = config.services.caddy;
   wg-ip = "100.64.0.6";
+  wg-int = config.services.tailscale.interfaceName;
 
   vw = {
     domain = config.services.vaultwarden.domain;
@@ -35,7 +36,11 @@ let
   tls-config = "tls {$CREDENTIALS_DIRECTORY}/sorre.internal.crt {$CREDENTIALS_DIRECTORY}/sorre.internal.key";
 in
 {
-  networking.firewall.allowedTCPPorts = [ blog.port ];
+  networking.firewall.interfaces."${wg-int}".allowedTCPPorts = [
+    config.services.caddy.httpPort
+    config.services.caddy.httpsPort
+    blog.port
+  ];
 
   services.caddy = {
     enable = true;