nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 29 Pull requests Wiki Activity Actions

Add network exposure posture host facts #16

New issue
Open
opened 2026-07-01 16:15:59 +01:00 by nimmo · 0 comments
nimmo commented 2026-07-01 16:15:59 +01:00
Owner
Copy link

Goal

Implement Priority 3 from projects/host-facts-refactor-roadmap.md: define a host-level network exposure posture that service modules can use as a default.

Acceptance Checklist

  • Add a host fact for network exposure posture.
  • Support values such as local, lan, vpn, and public.
  • Use it only as a default and not as permission to expose every service automatically.
  • Identify the first consumer modules that should respect it.

Proposed Shape

nixosConfig.network.exposure = "local";

Candidate Consumers

  • profiles.ollama.openWebUI
  • future reverse proxy modules
  • admin tools such as Dockge/Adminer
  • media-management service profiles

Notes

This changes security posture, so keep the behavior explicit and reviewable.

## Goal Implement Priority 3 from `projects/host-facts-refactor-roadmap.md`: define a host-level network exposure posture that service modules can use as a default. ## Acceptance Checklist - Add a host fact for network exposure posture. - Support values such as `local`, `lan`, `vpn`, and `public`. - Use it only as a default and not as permission to expose every service automatically. - Identify the first consumer modules that should respect it. ## Proposed Shape ```nix nixosConfig.network.exposure = "local"; ``` ## Candidate Consumers - `profiles.ollama.openWebUI` - future reverse proxy modules - admin tools such as Dockge/Adminer - media-management service profiles ## Notes This changes security posture, so keep the behavior explicit and reviewable.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/split-scoped-secrets
cosmos-postgres-vm-stable
electra-sddm-hyprland
pre-electra-disko-migration
Labels
Clear labels   
host:electra
Issues specific to the electra host.

  
host:fleet
Issues that span multiple hosts or the fleet as a whole.

  
host:lyra
Issues specific to the lyra host.

  
host:vega
Issues specific to the vega host.

  
host:vega

   
phase:cutover
The service cutover execution phase.

  
phase:deploy

   
phase:mcp

   
phase:module

   
phase:packaging

   
phase:prep
Preparation and preflight work before service cutover.

  
phase:validation
Post-cutover validation and rollback-window work.

  
project:attic-postgres-lyra-rollout
Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

  
project:auto-update-reliability
Work arising from the automated update reliability review.

  
project:declarative-purity-cleanup
Issues in the declarative purity cleanup workstream.

  
project:external-review
Review of external configurations for ideas and improvements

  
project:host-facts-refactor
Issues in the host facts refactor workstream.

  
project:lyra-nixos-deploy
Issues in the Lyra NixOS deployment workstream.

  
project:lyra-service-stack-migration
Issues in the lyra service stack migration workstream.

  
project:nebula-mesh-network
Issues in the Nebula mesh network workstream.

  
project:security-hardening
Work belonging to the Security Hardening milestone

  
project:service-stack-migration
Issues in the service stack migration workstream.

  
project:vega-sillytavern-cutover
Issues in the Vega SillyTavern cutover workstream.

  
service:auto-update
NixOS flake update, cache build, and consumer deployment automation.

  
service:mem0

   
service:sillytavern
Issues related to the SillyTavern service.

No labels
host:electra
host:fleet
host:lyra
host:vega
host:vega
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:declarative-purity-cleanup
project:external-review
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
service:auto-update
service:mem0
service:sillytavern
Milestone
Clear milestone
No items
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/nixos-config#16
No description provided.