diff --git a/lib/data/default.nix b/lib/data/default.nix
index a79178a0..b20f7f70 100644
--- a/lib/data/default.nix
+++ b/lib/data/default.nix
@@ -1,4 +1,5 @@
 {
   data.hosts = builtins.fromTOML (builtins.readFile ./hosts.toml);
   data.services = builtins.fromTOML (builtins.readFile ./services.toml);
+  data.tsNet = "coelacanth-dragon.ts.net";
 }
diff --git a/systems/x86_64-linux/prefect/services/caddy.nix b/systems/x86_64-linux/prefect/services/caddy.nix
index 05d04dec..7ac715c9 100644
--- a/systems/x86_64-linux/prefect/services/caddy.nix
+++ b/systems/x86_64-linux/prefect/services/caddy.nix
@@ -1,42 +1,36 @@
-{ pkgs, lib, ... }: let
+{ pkgs, lib, ... }:
+let
   pns = lib.py.data.services;
   marvin = lib.py.data.hosts.marvin.ts.ip4;
-  reverseProxyToMarvin = port: {
-  extraConfig = ''
-    reverse_proxy http://${marvin}:${toString port}
-  '';
+  tsNet = lib.py.data.tsNet;
+  reverseProxyToMarvin = port: ts: {
+    extraConfig = ''
+      reverse_proxy http://${marvin}:${toString port}
+      ${if ts then "tailscale_auth" else ""}
+    '';
   };
-  # Hosts that are just a reverse proxy declaration and nothing else
-  simpleHosts = [
-    "nextcloud"
-    "nextcloud-office"
-    "git"
-    "miniflux"
-    "iceshrimp"
-    "grafana"
-    "deemix"
-    "planka"
-  ];
-
-  simpleHostAttrs = lib.mapAttrs' (name: value: lib.nameValuePair "${pns.${name}.extUrl}" (reverseProxyToMarvin (toString pns.${value}.port)))
-    (lib.genAttrs simpleHosts (name: name));
-in {
+in
+{
   services.caddy = {
     enable = true;
     package = pkgs.caddy.withPlugins {
       plugins = [
         "github.com/caddy-dns/desec@v0.0.0-20240526070323-822a6a2014b2"
-        "github.com/greenpau/caddy-security@v1.1.29"
+        "github.com/greenpau/caddy-security@v1.1.31"
+        "github.com/tailscale/caddy-tailscale@v0.0.0-20250207163903-69a970c84556"
       ];
-      hash = "sha256-nfBjtwqn7UOGRr5Aqy0y1u9AYhWU9TLjbdhZ9uAwtHY=";
+      hash = "sha256-rvPZ/Lomx40tvlqqhUBIG9wCHJorN2FGus7gtO7ob/0=";
     };
     email = "pyrox@pyrox.dev";
     virtualHosts = {
       # Just get TLS certs for mailserver
-      "mail.pyrox.dev" = {};
+      "mail.pyrox.dev" = { };
       # Redirect old domains -> pyrox.dev
       "blog.pyrox.dev" = {
-        serverAliases = ["www.pyrox.dev" "thehedgehog.me"];
+        serverAliases = [
+          "www.pyrox.dev"
+          "thehedgehog.me"
+        ];
         extraConfig = ''
           redir https://pyrox.dev{uri} permanent
         '';
@@ -74,10 +68,10 @@ in {
       };
 
       # Authentik
-      "${pns.authentik.extUrl}:443" = reverseProxyToMarvin pns.authentik.port;
-      "${pns.authentik.extUrl}:80" = reverseProxyToMarvin pns.authentik.port;
-      "http://${pns.authentik.extUrl}:389" = reverseProxyToMarvin 389;
-      "${pns.authentik.extUrl}:636" = reverseProxyToMarvin 636;
+      "${pns.authentik.extUrl}:443" = reverseProxyToMarvin pns.authentik.port false;
+      "${pns.authentik.extUrl}:80" = reverseProxyToMarvin pns.authentik.port false;
+      "http://${pns.authentik.extUrl}:389" = reverseProxyToMarvin 389 false;
+      "${pns.authentik.extUrl}:636" = reverseProxyToMarvin 636 false;
 
       # Vaultwarden
       ${pns.vaultwarden.extUrl} = {
@@ -112,7 +106,6 @@ in {
           }
         '';
       };
-
       # Jellyfin
       ${pns.jellyfin.extUrl} = {
         extraConfig = ''
@@ -172,7 +165,70 @@ in {
           metrics /metrics
         '';
       };
-    } // simpleHostAttrs;
+      # SIMPLE HOSTS
+
+      # Forgejo
+      ${pns.git.extUrl} = {
+        extraConfig = ''
+          reverse_proxy http://${marvin}:${toString pns.git.port}
+        '';
+      };
+
+      # Grafana
+      ${pns.grafana.extUrl} = {
+        extraConfig = ''
+          reverse_proxy http://${marvin}:${toString pns.grafana.port}
+        '';
+      };
+
+      # Miniflux
+      ${pns.miniflux.extUrl} = {
+        extraConfig = ''
+          reverse_proxy http://${marvin}:${toString pns.miniflux.port}
+        '';
+      };
+
+      # Nextcloud
+      ${pns.nextcloud.extUrl} = {
+        extraConfig = ''
+          reverse_proxy http://${marvin}:${toString pns.nextcloud.port}
+        '';
+      };
+
+      # Nextcloud-Office(Collabora)
+      ${pns.nextcloud-office.extUrl} = {
+        extraConfig = ''
+          reverse_proxy http://${marvin}:${toString pns.nextcloud-office.port}
+        '';
+      };
+
+      # Planka
+      ${pns.planka.extUrl} = {
+        extraConfig = ''
+          reverse_proxy http://${marvin}:${toString pns.planka.port}
+        '';
+      };
+
+      # Simple Tailscale Hosts
+
+      # Deemix
+      "${pns.deemix.tsHost}.${tsNet}" = {
+        extraConfig = ''
+          bind tailscale/${pns.deemix.tsHost}
+          tailscale_auth
+          reverse_proxy http://${marvin}:${toString pns.deemix.port}
+        '';
+      };
+      # Pinchflat
+      "${pns.pinchflat.tsHost}.${tsNet}" = {
+        extraConfig = ''
+          bind tailscale/${pns.pinchflat.tsHost}
+          tailscale_auth
+          reverse_proxy http://${marvin}:${toString pns.pinchflat.port}
+        '';
+      };
+
+    };
   };
   systemd.services.caddy.serviceConfig.CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
   systemd.services.caddy.serviceConfig.AmbientCapabilities = "CAP_NET_BIND_SERVICE";