Enable nextcloud on alto

modules/system/tailscale/caddy-serve.nix

@@ -0,0 +1,69 @@
+{
+  config,
+  pkgs-unstable,
+  lib,
+  ...
+}:
+let
+  nodes = config.myConfig.tailscale.caddyServe |> lib.filterAttrs (_: value: value.enable);
+
+  caddy-tailscale = pkgs-unstable.caddy.withPlugins {
+    plugins = [ "github.com/tailscale/caddy-tailscale@v0.0.0-20250207163903-69a970c84556" ];
+    hash = "sha256-UR9CG/zIslkXHDj1fDWmhx8hJZ8VLvZzOTGvGqqx1Ls=";
+  };
+in
+{
+  options.myConfig.tailscale.caddyServe = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule (
+        { name, ... }:
+        {
+          options = {
+            enable = lib.mkEnableOption "" // {
+              default = true;
+            };
+            subdomain = lib.mkOption {
+              type = lib.types.nonEmptyStr;
+              default = name;
+            };
+            port = lib.mkOption {
+              type = lib.types.nullOr lib.types.port;
+              default = null;
+            };
+          };
+        }
+      )
+    );
+    default = { };
+  };
+
+  config = lib.mkIf (nodes != { }) {
+    sops.secrets."service-tailscale-auth-key" = {
+      owner = config.services.caddy.user;
+      inherit (config.services.caddy) group;
+    };
+
+    services.caddy = {
+      enable = true;
+      package = caddy-tailscale;
+      enableReload = false;
+
+      globalConfig = ''
+        tailscale {
+          auth_key {file.${config.sops.secrets."service-tailscale-auth-key".path}}
+        }
+      '';
+
+      virtualHosts = lib.mapAttrs' (
+        _: value:
+        lib.nameValuePair "https://${value.subdomain}.${config.networking.domain}" {
+          extraConfig = ''
+            bind tailscale/${value.subdomain}
+            tailscale_auth
+            reverse_proxy localhost:${toString value.port}
+          '';
+        }
+      ) nodes;
+    };
+  };
+}

modules/system/tailscale/default.nix

@@ -0,0 +1,58 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.myConfig.tailscale;
+in
+{
+  options.myConfig.tailscale = {
+    enable = lib.mkEnableOption "";
+    subdomain = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = config.networking.hostName;
+    };
+    ssh.enable = lib.mkEnableOption "";
+    exitNode.enable = lib.mkEnableOption "";
+    serve = lib.mkOption {
+      type = lib.types.nullOr lib.types.nonEmptyStr;
+      default = null;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    sops.secrets."tailscale-auth-key" = { };
+
+    services.tailscale = {
+      enable = true;
+      authKeyFile = config.sops.secrets."tailscale-auth-key".path;
+      openFirewall = true;
+      useRoutingFeatures = if (cfg.exitNode.enable || (cfg.serve != null)) then "server" else "client";
+      extraUpFlags = [ "--reset=true" ];
+      extraSetFlags = [
+        "--hostname=${cfg.subdomain}"
+        "--ssh=${lib.boolToString cfg.ssh.enable}"
+        "--advertise-exit-node=${lib.boolToString cfg.exitNode.enable}"
+      ];
+    };
+
+    systemd.services.tailscaled-set.after = [ "tailscaled-autoconnect.service" ];
+
+    systemd.services.tailscaled-serve = lib.mkIf (cfg.serve != null) {
+      after = [
+        "tailscaled.service"
+        "tailscaled-autoconnect.service"
+      ];
+      wants = [ "tailscaled.service" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig.Type = "oneshot";
+      script = ''
+        ${lib.getExe pkgs.tailscale} cert --min-validity 120h ${cfg.subdomain}.${config.networking.domain}
+        ${lib.getExe pkgs.tailscale} serve reset
+        ${lib.getExe pkgs.tailscale} serve --bg ${cfg.serve}
+      '';
+    };
+  };
+}