From 49bda4234ae4692abd83ad9accbc9e2e8a16da40 Mon Sep 17 00:00:00 2001
From: ginnoir <ginnoir@users.noreply.github.com>
Date: Sat, 6 Jun 2026 23:18:22 -0500
Subject: [PATCH] fix(caddy): make roms.ginnoir.com internal-only

External access for a trusted friend now goes through the share stack's
Tailscale serve node (roms-share.<tailnet>.ts.net), so roms.ginnoir.com
no longer needs public exposure. Add import internal_only (LAN + tailnet).
---
 Caddyfile | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Caddyfile b/Caddyfile
index 7f330d7..2d8c0ff 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -119,9 +119,12 @@ stash.ginnoir.com {
 }
 
 # =============================================================
-# GAMES / ROMS — public (temporarily; RomM has its own auth)
+# GAMES / ROMS — internal only
+# External access for a trusted friend is via the `share` stack's Tailscale
+# serve node (roms-share.<tailnet>.ts.net), NOT public exposure here.
 # =============================================================
 roms.ginnoir.com {
+	import internal_only
 	reverse_proxy romm:8080
 }