fix: scope prometheus exporter firewall rules to home hosts only

Move allowedTCPPorts for node/ping/systemd/blackbox exporters from
hosts/baseline.nix (applies to ALL hosts including linode) into
modules/nixos/home.nix (applies only to greg.home = true hosts).

This prevents ports 9100/9115/9427/9558 from being opened on linode,
which is internet-facing. All LAN hosts set greg.home = true and will
still get the ports opened; linode sets greg.home = false and will not.

hosts/baseline.nix

@@ -114,12 +114,6 @@
     };
   };
 
-  networking.firewall.allowedTCPPorts = [
-    9100 # prometheus node exporter
-    9427 # prometheus ping exporter
-    9558 # prometheus systemd exporter
-  ];
-
   security.sudo.extraRules = [
     {
       users = [ "greg" ];

modules/nixos/home.nix

@@ -46,5 +46,14 @@ with lib;
     systemd.tmpfiles.rules = [
       "d /var/lib/attic-client 0755 root root -"
     ];
+
+    # Open Prometheus exporter ports on LAN-connected hosts only.
+    # NOT in baseline.nix to avoid exposing these on internet-facing hosts (e.g. linode).
+    networking.firewall.allowedTCPPorts = [
+      9100 # prometheus node exporter
+      9115 # prometheus blackbox exporter
+      9427 # prometheus ping exporter
+      9558 # prometheus systemd exporter
+    ];
   };
 }