Now that Tailscale Services work (previous post) and I can give a Pi-hole service easily a name in my Tailscale network, I actually installed a Pi-hole. The initial setup was easy. The tricky part was IPv6.

{
  "ipv6": true
}

services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      # local port 80 is already used
      - "8314:80/tcp"
    environment:
      TZ: 'Europe/Berlin'
      FTLCONF_webserver_api_password: 'insert-a-secret-password-here'
      FTLCONF_dns_listeningMode: 'ALL'
    volumes:
      # persisting Pi-hole's databases and common configuration file
      - './etc-pihole:/etc/pihole'
    restart: unless-stopped
    # for IPv6
    cap_add:
      - NET_ADMIN
    networks:
      pihole-net:
        ipv6_address: fd42:cafe:dead:beef::53

networks:
  pihole-net:
    driver: bridge
    enable_ipv6: true
    ipam:
      config:
        - subnet: fd42:cafe:dead:beef::/64

[Resolve]
DNS=192.168.0.10
# DNS=fd7a:115c:a1e0::3c01:3638   # pi4c.tail07efb.ts.net
Domains=~

sudo apt update && sudo apt install systemd-resolved

[Resolve]
DNS=192.168.0.10
Domains=~

Having actual (Tailscale based) DNS entries for local services is something I was waiting for. In the past I added for some services a sidecar Docker container that adds that (i.e. for Forgejo).

Now with the release of Tailscale Services Beta this should be solved. So I tried to give my local Immich container a DNS entry and some https.

To figure this out I played around a bit until I figured out, that I need to add the host system of the containers as a tagged server and not as a user installed server. This is actually noted in the yellow box in the docs.

So first step is: How can I get the user based machine to become a tag based one. First we need to add a tag in the access controls tab. I named mine tag:local-servers. Then I created an Auth key with add Linux server. The important part is the key. I didn't use the generated command, because the Raspberry PI has already Tailscale installed. To change the machine from User based to Auth key based I did this on the commandline of my Raspberry PI:

sudo tailscale logout
sudo tailscale up --auth-key=tskey-auth-XXXXXX --reset --advertise-tags=tag:local-servers

The --reset was needed for me because I did expose this machine sometime in the past as exit-node. This is maybe not needed for other machines. The server is now back in Tailnet but has a tag below it's name in the Machine list. 🎉

Now the actual service. First I created a tag named local-services for all services I want to add. My current tags look like this:

One is for the local servers and one for the local services. I don't need any grants, because the Tailscale network has only one user and everything is routed to everywhere.

All prerequisites are there, I created an immich service with tcp:443 and the local-services tag attached. On the cli of the Raspberry PI that is running the Immich container this adds the immich to the service:

sudo tailscale serve --service=svc:immich --https=443 localhost:2283

I didn't add any auto approver, so I have to approve manually

And after the first time it needs a bit of time, probably for the Let's Encrypt dance. But then it just works:

I added a few other services, but I will probably keep the sidecar for Forgejo for now.

This Tailscale Services feature can do way more than I need. Thanks Tailscale! 🚀

http:
  use_x_forwarded_for: true
  server_host: 0.0.0.0
  trusted_proxies:
    - 127.0.0.1

For quite some time I have the plan to build a Nikola Plugin. The idea is to show a note at the top of every blog post that is older than one year. Of course all my posts have a date, but I want to increase the awareness, that older posts could be outdated -- I don't plan to update older posts.

I build the plugin with help from Claude. The code needed a few iterations and quite a bit of persistence handling Claude to figure out a solution that is not regenerating every time something changes and to not breaking the livereload of nikola auto.

The plugin adds a Javascript file to the assets and injects a short script tag to every blog post. When the page is rendered by a browser that supports Javascript, the Javascript adds a note above the headline of the post if the post is older than one year. The note looks like this for a post that is a few years old:

The plugin implements Nikola's LateTask interface. It creates an injection task for each blog post that tracks each HTML file's modification time via file_dep. Each injection task uses a check to avoid re-injecting if the script is already present. This dependency chain should only trigger an update when the blog post is actually rendered, to add the short Javascript call in there again.

The full code is on Github at: https://github.com/mfa/nikola-post-age-warning.