From 4eebf07f6bfa42b3ca5658d34c6df3dc0f44ddfb Mon Sep 17 00:00:00 2001 From: root Date: Wed, 25 Mar 2026 09:46:26 -0500 Subject: [PATCH] fix: scope prometheus exporter firewall rules to home hosts only Move allowedTCPPorts for node/ping/systemd/blackbox exporters from hosts/baseline.nix (applies to ALL hosts including linode) into modules/nixos/home.nix (applies only to greg.home = true hosts). This prevents ports 9100/9115/9427/9558 from being opened on linode, which is internet-facing. All LAN hosts set greg.home = true and will still get the ports opened; linode sets greg.home = false and will not. --- hosts/baseline.nix | 6 ------ modules/nixos/home.nix | 9 +++++++++ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/hosts/baseline.nix b/hosts/baseline.nix index 4c70936..1a59328 100644 --- a/hosts/baseline.nix +++ b/hosts/baseline.nix @@ -114,12 +114,6 @@ }; }; - networking.firewall.allowedTCPPorts = [ - 9100 # prometheus node exporter - 9427 # prometheus ping exporter - 9558 # prometheus systemd exporter - ]; - security.sudo.extraRules = [ { users = [ "greg" ]; diff --git a/modules/nixos/home.nix b/modules/nixos/home.nix index 0e2d67f..dc69397 100644 --- a/modules/nixos/home.nix +++ b/modules/nixos/home.nix @@ -46,5 +46,14 @@ with lib; systemd.tmpfiles.rules = [ "d /var/lib/attic-client 0755 root root -" ]; + + # Open Prometheus exporter ports on LAN-connected hosts only. + # NOT in baseline.nix to avoid exposing these on internet-facing hosts (e.g. linode). + networking.firewall.allowedTCPPorts = [ + 9100 # prometheus node exporter + 9115 # prometheus blackbox exporter + 9427 # prometheus ping exporter + 9558 # prometheus systemd exporter + ]; }; }