---
title: 'Einzelne Bereiche zb /administrator in Joomla'
url: 'https://blog.ro011110ot.de/de/vps/tailscale-only'
markdown: 'https://blog.ro011110ot.de/de/vps/tailscale-only.md'
lang: de
date: '2026-10-05'
description: 'Einzelne Bereiche zb /administrator in Joomla # ========================================================================= # Tailscale Firewall (Early execution at server context) # ========================================================================= set $block_unauthorized_admin 0; # Step 1: …'
---

## Einzelne Bereiche zb /administrator in Joomla

```Plaintext
# =========================================================================
# Tailscale Firewall (Early execution at server context)
# =========================================================================
set $block_unauthorized_admin 0;

# Step 1: Check if the current URI belongs to Joomla admin or API (using $uri)
if ($uri ~* "^/(administrator|api)") {
    set $block_unauthorized_admin 1;
}

# Step 2: If the IP matches the Tailscale range (100.64.0.0/10), reset the flag
if ($remote_addr ~ "^100\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\.") {
    set $block_unauthorized_admin 0;
}

# Step 3: Deny access with a 403 Forbidden if the flag is still set to 1
if ($block_unauthorized_admin = 1) {
    return 403;
}

```

 Caution

`fastcgi_pass unix:/run/php/web???.sock;``???` durch den passenden User ersetzen

## Proxy

```
# =========================================================================
# Global Server Security: Restrict entire Subdomain to Tailscale Only
# =========================================================================
# 1. Let's Encrypt allow
location ^~ /.well-known/acme-challenge/ {
    allow all;
}

# 2. Exclude ISPConfig error pages from Tailscale restrictions
location ^~ /error/ {
    allow all;
}

# 3. Only Tailscale for everything else
allow 100.64.0.0/10;
deny all;

# =========================================================================
# Reverse Proxy Configuration
# =========================================================================
location / {
    proxy_pass http://127.0.0.1:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # WebSocket support (highly recommended for modern web apps)
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    # Buffering tweaks
    proxy_connect_timeout 90s;
    proxy_send_timeout 90s;
    proxy_read_timeout 90s;
    proxy_buffering off;
}

```

 Caution

`fastcgi_pass unix:/run/php/web???.sock;``???` durch den passenden User ersetzen

## Komplette Subdomain

```
# =========================================================================
# Global Server Security: Restrict entire PHP Subdomain to Tailscale Only
# =========================================================================
# 1. Let's Encrypt allow
location ^~ /.well-known/acme-challenge/ {
    allow all;
}

# 2. Exclude ISPConfig error pages from Tailscale restrictions
location ^~ /error/ {
    allow all;
}

# 3. Only Tailscale for everything else
allow 100.64.0.0/10;
deny all;

```

---

## Navigation

- Previous: [1. System vorbereiten](https://blog.ro011110ot.de/de/vps/syncthing-v2-auf-debian-installieren-obsidian-guide.md)
- Next: [1. Bot erstellen & Telegram-ID herausfinden](https://blog.ro011110ot.de/de/vps/telegram-bot.md)