nix-stuff/roles/server/caddy.nix

{...}: {
  services.caddy = {
    enable = true;
    extraConfig = ''
      (tailscale) {
        tls internal
        bind 100.73.96.48
      }
    '';
  };
}