1{
 2  den,
 3  lib,
 4  ...
 5}: {
 6  den.aspects.services.webserver = {
 7    settings = {
 8      external = lib.mkOption {
 9        description = ''
10          Whether this host's webserver is publicly reachable. Every host serves
11          its own Tailscale-only reverse proxies. When true, caddy additionally
12          serves the fleet-wide public reverse proxies on every interface
13          (0.0.0.0/::), and its Tailscale-only vhosts are kept off the public
14          interface by rejecting non-Tailscale source IPs. When false, caddy
15          only serves the host's own Tailscale reverse proxies, bound to the
16          host's own Tailscale IP.
17        '';
18        type = lib.types.bool;
19        default = false;
20      };
21    };
22
23    includes = [
24      den.aspects.services.webserver.reverse-proxy-processer
25      den.aspects.services.webserver.reverse-proxy-tailscale-processer
26
27      den.aspects.services.webserver.caddy
28    ];
29  };
30}