Tried a bunch of stuff with caddy-tailscale, but couldn't get
`tailscale_auth` to work through a non-Tailscale listener.

diff --git a/lotus-land-story/caddy.yml b/lotus-land-story/caddy.yml
index 6d7e7e4..24f478d 100644
--- a/lotus-land-story/caddy.yml
+++ b/lotus-land-story/caddy.yml
@@ -20,6 +20,10 @@
         name: lotus_land_story
       register: docker_network
 
+    - name: Get Perfect Cherry Blossom IP
+      command: tailscale ip --1 Perfect-Cherry-Blossom
+      register: perfect_cherry_blossom_ip_result
+
     # TODO Reload Caddy when this changes:
     #      docker exec -w /etc/caddy $caddy_container_id caddy reload
     - name: Set up Caddyfile
@@ -29,6 +33,7 @@
         mode: "0644"
       vars:
         trusted_proxies: "{{ docker_network.network.IPAM.Config[0].Subnet }}"
+        perfect_cherry_blossom_ip: "{{ perfect_cherry_blossom_ip_result.stdout }}"
 
     - name: Run Caddy
       community.docker.docker_container:
diff --git a/lotus-land-story/templates/Caddyfile b/lotus-land-story/templates/Caddyfile
index 0debbf7..e0fa31e 100644
--- a/lotus-land-story/templates/Caddyfile
+++ b/lotus-land-story/templates/Caddyfile
@@ -1,6 +1,8 @@
 {
 	servers {
 		metrics
+		trusted_proxies static private_ranges {{ trusted_proxies }}
+		trusted_proxies_strict
 	}
 
 	tailscale {
@@ -133,6 +135,11 @@ docs {
 ### External
 
 git.kejadlen.dev
+	@perfect-cherry-blossom client_ip {{ perfect_cherry_blossom_ip }}
+	reverse_proxy @perfect-cherry-blossom gitea:3000 {
+		header_up X-Webauth-User alpha
+	}
+
 	reverse_proxy gitea:3000
 }