4 files changed, 42 insertions, 33 deletions
diff --git a/hosts/tower/default.nix b/hosts/tower/default.nix
index 9b8f652..ce72046 100644
--- a/hosts/tower/default.nix
+++ b/hosts/tower/default.nix
@@ -1,4 +1,4 @@
-{ ... }:
+{ pkgs, ... }:
 {
   imports = [
     # Include the results of the hardware scan.
@@ -47,6 +47,8 @@
     };
   };
 
+  environment.systemPackages = [ pkgs.git pkgs.helix ];
+
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave
diff --git a/hosts/tower/network.nix b/hosts/tower/network.nix
index fc0fdc5..09a97a3 100644
--- a/hosts/tower/network.nix
+++ b/hosts/tower/network.nix
@@ -1,7 +1,17 @@
-{ ... }:
+{ config, ... }:
 {
   networking = {
     hostName = "tower";
     networkmanager.enable = true;
+    firewall = {
+      checkReversePath = "loose";
+      trustedInterfaces = [ "tailscale0" ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
+  };
+
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
   };
 }
diff --git a/hosts/tower/web/default.nix b/hosts/tower/web/default.nix
index 2424eaf..76429b7 100644
--- a/hosts/tower/web/default.nix
+++ b/hosts/tower/web/default.nix
@@ -1,11 +1,11 @@
 { ... }:
 {
   imports = [
-    ./blog.nix
-    ./mediadb.nix
-    ./git.nix
-    ./static.nix
-    ./navidrome.nix
-    ./vaultwarden.nix
+    # ./blog.nix
+    # ./mediadb.nix
+    # ./git.nix
+    # ./static.nix
+    # ./navidrome.nix
+    # ./vaultwarden.nix
   ];
 }
diff --git a/hosts/tower/web/git.nix b/hosts/tower/web/git.nix
index 4dcae8e..e94b1d3 100644
--- a/hosts/tower/web/git.nix
+++ b/hosts/tower/web/git.nix
@@ -11,34 +11,31 @@ in
 {
   services.nginx = {
     enable = true;
-    virtualHosts."${domainInternal}" = {
-      # forceSSL = true;
-      # sslCertificateKey = secrets."wg-ca-key".path;
-      # sslCertificate = secrets."wg-ca-crt".path;
-      listen = [
-        {
-          addr = "100.64.0.3";
-          port = 443;
-          # ssl = true;
-        }
-      ];
-    };
+    # virtualHosts."${domainInternal}" = {
+    #   forceSSL = true;
+    #   # sslCertificateKey = secrets."wg-ca-key".path;
+    #   # sslCertificate = secrets."wg-ca-crt".path;
+    #   listen = [
+    #     {
+    #       addr = "100.64.0.3";
+    #       port = 443;
+    #       # ssl = true;
+    #     }
+    #   ];
+    # };
 
-    virtualHosts."${domainPublic}" = {
-      # enableACME = true;
-      # forceSSL = true;
-    };
+    # virtualHosts."${domainPublic}" = { };
   };
 
-  services.cgit.internal = {
-    enable = true;
-    user = "cgit-internal";
-    group = "cgit";
-    nginx.virtualHost = domainInternal;
-    gitHttpBackend.checkExportOkFiles = false;
-    scanPath = "/var/lib/git/repos/isabella";
-    settings = commonSettings;
-  };
+  # services.cgit.internal = {
+  #   enable = true;
+  #   user = "cgit-internal";
+  #   group = "cgit";
+  #   nginx.virtualHost = domainInternal;
+  #   gitHttpBackend.checkExportOkFiles = false;
+  #   scanPath = "/var/lib/git/repos/isabella";
+  #   settings = commonSettings;
+  # };
 
   services.cgit.public = {
     enable = true;