From 785150a8540262e530c321e96964cf4affd1256b Mon Sep 17 00:00:00 2001
From: Isabella Bastaja <isabella@sorre.xyz>
Date: Tue, 27 Oct 2026 02:17:47 +0100
Subject: tower: open caddy ports on tailnet

---
 hosts/tower/web/caddy.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hosts/tower/web/caddy.nix b/hosts/tower/web/caddy.nix
index 5efdbc3..2bead84 100644
--- a/hosts/tower/web/caddy.nix
+++ b/hosts/tower/web/caddy.nix
@@ -8,6 +8,7 @@
 let
   cfg = config.services.caddy;
   wg-ip = "100.64.0.6";
+  wg-int = config.services.tailscale.interfaceName;
 
   vw = {
     domain = config.services.vaultwarden.domain;
@@ -35,7 +36,11 @@ let
   tls-config = "tls {$CREDENTIALS_DIRECTORY}/sorre.internal.crt {$CREDENTIALS_DIRECTORY}/sorre.internal.key";
 in
 {
-  networking.firewall.allowedTCPPorts = [ blog.port ];
+  networking.firewall.interfaces."${wg-int}".allowedTCPPorts = [
+    config.services.caddy.httpPort
+    config.services.caddy.httpsPort
+    blog.port
+  ];
 
   services.caddy = {
     enable = true;
-- 
cgit v1.3.1