Add network exposure posture host facts #16

New issue

Closed

opened 2026-07-01 16:15:59 +01:00 by nimmo · 2 comments

nimmo commented

2026-07-01 16:15:59 +01:00

Owner

Goal

Implement Priority 3 from projects/host-facts-refactor-roadmap.md: define a host-level network exposure posture that service modules can use as a default.

Acceptance Checklist

Add a host fact for network exposure posture.
Support values such as local, lan, vpn, and public.
Use it only as a default and not as permission to expose every service automatically.
Identify the first consumer modules that should respect it.

Guardrails

A posture is a safe default, not an automatic firewall-opening mechanism.
Each listener retains an explicit service-level bind and access decision.
public means authenticated reverse-proxy/tunnel ingress, never a directly opened application port.

Initial declarative inventory — 2026-08-10

This inventory is from evaluated NixOS firewall configuration, not a runtime port scan.

Host	Direct TCP	Nebula TCP/UDP	Initial posture
electra	none	TCP 22	mesh-managed laptop
lena	none	TCP 22	mesh-managed laptop
vega	22, 8081, 18080	TCP 53, 6767, 8383, 8780, 37840; UDP 53	mixed server; review each non-SSH listener
lyra	22, 80, 443, 3280, 8081, 8265, 8266, 8888, 9999, 10200, 10300, 11434, 45876	TCP 6767	highest-priority review target
cosmos	22	TCP 22, 5432, 8050	mesh-only database/admin services
chaos	22	TCP 22	minimal VM exposure

Decision workflow

Classify service listeners in focused batches. For each record the intended audience, bind address, ingress path, authentication, and whether a client without Nebula needs access.

Administrative and control-plane services: Backrest, Attic, databases, Adminer, Dockge, MCP endpoints.
Mesh machine APIs: Engram, Paseo, Trilium, Ollama, DNS.
User-facing web and media services: BookStack, Jellyfin, Immich, ARR tools.
Infrastructure/protocol listeners: SSH, NFS, reverse-proxy ports.

Initial candidate defaults

local: loopback only, no firewall rule.
vpn: Nebula bind/address and an explicit mesh firewall rule.
lan: physical LAN bind/rule only for clients that cannot use Nebula.
public: loopback or container-private application listener behind authenticated ingress.

Next deliverable

Review the Lyra LAN listener set and Vega's mixed direct/mesh listeners as the first decision batches. Only after those decisions are recorded should a nixosConfig.network.exposure option and first consumer module be implemented.

## Goal Implement Priority 3 from `projects/host-facts-refactor-roadmap.md`: define a host-level network exposure posture that service modules can use as a default. ## Acceptance Checklist - Add a host fact for network exposure posture. - Support values such as `local`, `lan`, `vpn`, and `public`. - Use it only as a default and not as permission to expose every service automatically. - Identify the first consumer modules that should respect it. ## Guardrails - A posture is a safe default, not an automatic firewall-opening mechanism. - Each listener retains an explicit service-level bind and access decision. - `public` means authenticated reverse-proxy/tunnel ingress, never a directly opened application port. ## Initial declarative inventory — 2026-08-10 This inventory is from evaluated NixOS firewall configuration, not a runtime port scan. | Host | Direct TCP | Nebula TCP/UDP | Initial posture | | --- | --- | --- | --- | | electra | none | TCP 22 | mesh-managed laptop | | lena | none | TCP 22 | mesh-managed laptop | | vega | 22, 8081, 18080 | TCP 53, 6767, 8383, 8780, 37840; UDP 53 | mixed server; review each non-SSH listener | | lyra | 22, 80, 443, 3280, 8081, 8265, 8266, 8888, 9999, 10200, 10300, 11434, 45876 | TCP 6767 | highest-priority review target | | cosmos | 22 | TCP 22, 5432, 8050 | mesh-only database/admin services | | chaos | 22 | TCP 22 | minimal VM exposure | ## Decision workflow Classify service listeners in focused batches. For each record the intended audience, bind address, ingress path, authentication, and whether a client without Nebula needs access. 1. Administrative and control-plane services: Backrest, Attic, databases, Adminer, Dockge, MCP endpoints. 2. Mesh machine APIs: Engram, Paseo, Trilium, Ollama, DNS. 3. User-facing web and media services: BookStack, Jellyfin, Immich, ARR tools. 4. Infrastructure/protocol listeners: SSH, NFS, reverse-proxy ports. ## Initial candidate defaults - `local`: loopback only, no firewall rule. - `vpn`: Nebula bind/address and an explicit mesh firewall rule. - `lan`: physical LAN bind/rule only for clients that cannot use Nebula. - `public`: loopback or container-private application listener behind authenticated ingress. ## Next deliverable Review the Lyra LAN listener set and Vega's mixed direct/mesh listeners as the first decision batches. Only after those decisions are recorded should a `nixosConfig.network.exposure` option and first consumer module be implemented.

nimmo added this to the Host Facts Refactor milestone

2026-07-01 16:15:59 +01:00

nimmo added the

project:host-facts-refactor

host:fleet

labels

2026-07-01 16:15:59 +01:00

nimmo commented

2026-08-10 18:14:05 +01:00

Author

Owner

Correction to the initial exposure inventory: Attic is a public/proxied service, not LAN or Nebula. Lyra and Vega are load-balanced Newt tunnel backends for https://attic.nimmog.uk; clients must not access port 8081 directly. The current shared Attic module still listens on 0.0.0.0:8081 and opens the global firewall port, so the #16 implementation must move the backend to a Newt-reachable loopback listener and remove the direct firewall exception. Verify the Pangolin/Newt target before changing the bind address.

nimmo commented

2026-08-10 18:16:10 +01:00

Author

Owner

Live Pangolin verification: Attic resource 62 is healthy and load-balances Newt targets 63 (vega-nix, 192.168.8.108:8081) and 67 (lyra, 192.168.8.146:8081). The healthy BookStack Newt target on Vega already uses 127.0.0.1:80, confirming loopback is supported. Safe ordering: first change both Attic targets to 127.0.0.1:8081 and confirm both health checks remain green; then deploy the shared Nix change that binds atticd to loopback and removes firewall port 8081 on both hosts.

nimmo referenced this issue

2026-08-10 18:33:25 +01:00

feat(newt): add native Lyra tunnel client #160

nimmo referenced this issue from a pull request that will close it,

2026-08-10 19:18:17 +01:00

fix(attic): restrict cache backends to loopback #161

nimmo closed this issue

2026-08-10 19:49:32 +01:00

nimmo referenced this issue

2026-08-10 19:55:25 +01:00

fix(attic): restrict cache backends to loopback #161