Change:
Despite the name, tailscale's nginx-auth application works fine with both caddy and traefik. Unfortunately, the nixos service for it is tightly coupled with nginx. It should be possible to run the auth service without enabling nginx. N/A Please run and paste the result.

Discussion:
./services/networking/syncthing-relay.nix ./services/networking/syncthing.nix ./services/networking/tailscale.nix <ins> ./services/networking/tailscale-auth.nix </ins> ./services/networking/tayga.nix ./services/networking/tcpcrypt.nix ./services/networking/teamspeak3.nix

<ins> { config, lib, pkgs, ... }: let inherit (lib) getExe maintainers mkEnableOption mkPackageOption mkIf mkOption types ; cfg = config.services.tailscaleAuth; in { options.services.tailscaleAuth = { enable = mkEnableOption "Enable tailscale.nginx-auth, to authenticate users via tailscale."; package = mkPackageOption pkgs "tailscale-nginx-auth" {}; user = mkOption { type = types.str; default = "tailscale-nginx-auth"; description = "User which runs tailscale-nginx-auth"; }; group = mkOption { type = types.str; default = "tailscale-nginx-auth"; description = "Group which runs tailscale-nginx-auth"; }; socketPath = mkOption { default = "/run/tailscale-nginx-auth/tailscale-nginx-auth.sock"; type = types.path; description = '' Path of the socket listening to authorization requests. ''; }; }; config = mkIf cfg.enable { services.tailscale.enable = true; users.users.${cfg.user} = { isSystemUser = true; inherit (cfg) group; }; users.groups.${cfg.group} = { }; systemd.sockets.tailscale-nginx-auth = { description = "Tailscale NGINX Authentication socket"; partOf = [ "tailscale-nginx-auth.service" ]; wantedBy = [ "sockets.target" ]; listenStreams = [ cfg.socketPath ]; socketConfig = { SocketMode = "0660"; SocketUser = cfg.user; SocketGroup = cfg.group; }; }; systemd.services.tailscale-nginx-auth = { description = "Tailscale NGINX Authentication service"; requires = [ "tailscale-nginx-auth.socket" ]; serviceConfig = { ExecStart = getExe cfg.package; RuntimeDirectory = "tailscale-nginx-auth"; User = cfg.user; Group = cfg.group; BindPaths = [ "/run/tailscale/tailscaled.sock" ]; CapabilityBoundingSet = ""; DeviceAllow = ""; LockPersonality = true; MemoryDenyWriteExecute = true; PrivateDevices = true; PrivateUsers = true; ProtectClock = true; ProtectControlGroups = true; ProtectHome = true; ProtectHostname = true; ProtectKernelLogs = true; ProtectKernelModules = true; ProtectKernelTunables = true; RestrictNamespaces = true; RestrictAddressFamilies = [ "AF_UNIX" ]; RestrictRealtime = true; RestrictSUIDSGID = true; SystemCallArchitectures = "native"; SystemCallErrorNumber = "EPERM"; SystemCallFilter = [ "@system-service" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid" ]; }; }; }; meta.maintainers = with maintainers; [ dan-theriault phaer ]; } </ins>

{ config, lib, pkgs, ... }: <del> with lib; </del> let <ins> inherit (lib) genAttrs maintainers mkAliasOptionModule mkEnableOption mkIf mkOption types ; </ins> cfg = config.services.nginx.tailscaleAuth; <ins> cfgAuth = config.services.tailscaleAuth; </ins> in { <ins> imports = [ (mkAliasOptionModule [ "services" "nginx" "tailscaleAuth" "package" ] [ "services" "tailscaleAuth" "package" ]) (mkAliasOptionModule [ "services" "nginx" "tailscaleAuth" "user" ] [ "services" "tailscaleAuth" "user" ]) (mkAliasOptionModule [ "services" "nginx" "tailscaleAuth" "group" ] [ "services" "tailscaleAuth" "group" ]) (mkAliasOptionModule [ "services" "nginx" "tailscaleAuth" "socketPath" ] [ "services" "tailscaleAuth" "socketPath" ]) ]; </ins> options.services.nginx.tailscaleAuth = { enable = mkEnableOption "Enable tailscale.nginx-auth, to authenticate nginx users via tailscale."; <del> package = lib.mkPackageOptionMD pkgs "tailscale-nginx-auth" {}; user = mkOption { type = types.str; default = "tailscale-nginx-auth"; description = "User which runs tailscale-nginx-auth"; }; group = mkOption { type = types.str; default = "tailscale-nginx-auth"; description = "Group which runs tailscale-nginx-auth"; }; </del> expectedTailnet = mkOption { default = ""; type = types.nullOr types.str;

''; }; <del> socketPath = mkOption { default = "/run/tailscale-nginx-auth/tailscale-nginx-auth.sock"; type = types.path; description = '' Path of the socket listening to nginx authorization requests. ''; }; </del> virtualHosts = mkOption { type = types.listOf types.str; default = [];

}; config = mkIf cfg.enable { <del> services.tailscale.enable = true; </del> <ins> services.tailscaleAuth.enable = true; </ins> services.nginx.enable = true; <del> users.users.${cfg.user} = { isSystemUser = true; inherit (cfg) group; }; users.groups.${cfg.group} = { }; users.users.${config.services.nginx.user}.extraGroups = [ cfg.group ]; systemd.sockets.tailscale-nginx-auth = { description = "Tailscale NGINX Authentication socket"; partOf = [ "tailscale-nginx-auth.service" ]; wantedBy = [ "sockets.target" ]; listenStreams = [ cfg.socketPath ]; socketConfig = { SocketMode = "0660"; SocketUser = cfg.user; SocketGroup = cfg.group; }; }; </del> <ins> users.users.${config.services.nginx.user}.extraGroups = [ cfgAuth.group ]; </ins> systemd.services.tailscale-nginx-auth = { <del> description = "Tailscale NGINX Authentication service"; </del> after = [ "nginx.service" ]; wants = [ "nginx.service" ]; <del> requires = [ "tailscale-nginx-auth.socket" ]; serviceConfig = { ExecStart = "${lib.getExe cfg.package}"; RuntimeDirectory = "tailscale-nginx-auth"; User = cfg.user; Group = cfg.group; BindPaths = [ "/run/tailscale/tailscaled.sock" ]; CapabilityBoundingSet = ""; DeviceAllow = ""; LockPersonality = true; MemoryDenyWriteExecute = true; PrivateDevices = true; PrivateUsers = true; ProtectClock = true; ProtectControlGroups = true; ProtectHome = true; ProtectHostname = true; ProtectKernelLogs = true; ProtectKernelModules = true; ProtectKernelTunables = true; RestrictNamespaces = true; RestrictAddressFamilies = [ "AF_UNIX" ]; RestrictRealtime = true; RestrictSUIDSGID = true; SystemCallArchitectures = "native"; SystemCallErrorNumber = "EPERM"; SystemCallFilter = [ "@system-service" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid" ]; }; </del> }; services.nginx.virtualHosts = genAttrs

extraConfig = '' internal; <del> proxy_pass http://unix:${cfg.socketPath}; </del> <ins> proxy_pass http://unix:${cfgAuth.socketPath}; </ins> proxy_pass_request_body off; # Upstream uses $http_host here, but we are using gixy to check nginx configurations