nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 29 Pull requests Wiki Activity Actions

Reduce direct exposure of administrative services #38

New issue
Open
opened 2026-07-01 19:36:48 +01:00 by nimmo · 0 comments
nimmo commented 2026-07-01 19:36:48 +01:00
Owner
Copy link

Context

The lyra and planned nova configurations expose several administrative or browser-facing services directly through host firewalls. Exposure should be intentional and constrained to the required trust boundary.

Relevant files:

  • hosts/lyra/default.nix
  • potential/nova/default.nix
  • modules/profiles/ollama.nix

Scope

  • Bind admin applications and databases to loopback where practical.
  • Put browser-facing services behind an authenticated reverse proxy or restrict them to VPN/mesh access.
  • Review Dockge, Adminer, PostgreSQL, media-management tools, Ollama, and Open WebUI.
  • Explicitly document any accepted LAN-wide exposure, including nova's intended Ollama/Open WebUI access.

Completion criteria

  • Every directly exposed administrative service has a documented reason and trust boundary.
  • Unnecessary firewall openings are removed.
  • Intended access paths are tested after deployment.
## Context The lyra and planned nova configurations expose several administrative or browser-facing services directly through host firewalls. Exposure should be intentional and constrained to the required trust boundary. Relevant files: - `hosts/lyra/default.nix` - `potential/nova/default.nix` - `modules/profiles/ollama.nix` ## Scope - Bind admin applications and databases to loopback where practical. - Put browser-facing services behind an authenticated reverse proxy or restrict them to VPN/mesh access. - Review Dockge, Adminer, PostgreSQL, media-management tools, Ollama, and Open WebUI. - Explicitly document any accepted LAN-wide exposure, including nova's intended Ollama/Open WebUI access. ## Completion criteria - Every directly exposed administrative service has a documented reason and trust boundary. - Unnecessary firewall openings are removed. - Intended access paths are tested after deployment.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/split-scoped-secrets
cosmos-postgres-vm-stable
electra-sddm-hyprland
pre-electra-disko-migration
Labels
Clear labels   
host:electra
Issues specific to the electra host.

  
host:fleet
Issues that span multiple hosts or the fleet as a whole.

  
host:lyra
Issues specific to the lyra host.

  
host:vega
Issues specific to the vega host.

  
host:vega

   
phase:cutover
The service cutover execution phase.

  
phase:deploy

   
phase:mcp

   
phase:module

   
phase:packaging

   
phase:prep
Preparation and preflight work before service cutover.

  
phase:validation
Post-cutover validation and rollback-window work.

  
project:attic-postgres-lyra-rollout
Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

  
project:auto-update-reliability
Work arising from the automated update reliability review.

  
project:declarative-purity-cleanup
Issues in the declarative purity cleanup workstream.

  
project:external-review
Review of external configurations for ideas and improvements

  
project:host-facts-refactor
Issues in the host facts refactor workstream.

  
project:lyra-nixos-deploy
Issues in the Lyra NixOS deployment workstream.

  
project:lyra-service-stack-migration
Issues in the lyra service stack migration workstream.

  
project:nebula-mesh-network
Issues in the Nebula mesh network workstream.

  
project:security-hardening
Work belonging to the Security Hardening milestone

  
project:service-stack-migration
Issues in the service stack migration workstream.

  
project:vega-sillytavern-cutover
Issues in the Vega SillyTavern cutover workstream.

  
service:auto-update
NixOS flake update, cache build, and consumer deployment automation.

  
service:mem0

   
service:sillytavern
Issues related to the SillyTavern service.

No labels
host:electra
host:fleet
host:lyra
host:vega
host:vega
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:declarative-purity-cleanup
project:external-review
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
service:auto-update
service:mem0
service:sillytavern
Milestone
Clear milestone
No items
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/nixos-config#38
No description provided.