nimmo/nixos-config

Watch

Fork 0

fix(attic): restrict cache backends to loopback #161

Merged

nimmo merged 1 commit from issue-16-attic-loopback into main

2026-08-10 19:49:31 +01:00

nimmo commented

2026-08-10 19:18:17 +01:00

Owner

Summary

bind the shared Attic service to 127.0.0.1:8081
remove the direct TCP/8081 firewall exception from Vega and Lyra
retain only the public, load-balanced Newt/Pangolin ingress at https://attic.nimmog.uk

Scope

Refs #16. This resolves the Attic portion of the exposure audit but does not close #16; the host-level posture fact and remaining listener classifications are still outstanding.

Validation

nix flake check
evaluated Vega and Lyra Attic listeners as 127.0.0.1:8081
evaluated direct TCP lists: Vega [22, 18080]; Lyra has no 8081
verified both Pangolin Attic targets are healthy at 127.0.0.1:8081 before this configuration change

Deployment evidence still required

Canary the change on one backend and confirm both Pangolin health checks plus https://attic.nimmog.uk/nixos/nix-cache-info; then deploy the other backend and repeat the public endpoint check.

## Summary - bind the shared Attic service to `127.0.0.1:8081` - remove the direct TCP/8081 firewall exception from Vega and Lyra - retain only the public, load-balanced Newt/Pangolin ingress at `https://attic.nimmog.uk` ## Scope Refs #16. This resolves the Attic portion of the exposure audit but does **not** close #16; the host-level posture fact and remaining listener classifications are still outstanding. ## Validation - `nix flake check` - evaluated Vega and Lyra Attic listeners as `127.0.0.1:8081` - evaluated direct TCP lists: Vega `[22, 18080]`; Lyra has no `8081` - verified both Pangolin Attic targets are healthy at `127.0.0.1:8081` before this configuration change ## Deployment evidence still required Canary the change on one backend and confirm both Pangolin health checks plus `https://attic.nimmog.uk/nixos/nix-cache-info`; then deploy the other backend and repeat the public endpoint check.

nimmo added this to the Host Facts Refactor milestone

2026-08-10 19:18:17 +01:00

nimmo added 1 commit

2026-08-10 19:18:17 +01:00

fix(attic): restrict cache backends to loopback

Build and Push Attic Cache / test (pull_request) Successful in 1m8s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

AI pull-request review / review (pull_request) Successful in 1m52s

Details

e236ce9f79

nimmo commented

2026-08-10 19:20:09 +01:00

Author

Owner

Automated code review

Reviewed commit: e236ce9f7960a3ec9bd4fdf5c1afd76675a40e89

Verdict: Ready to merge

No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory.

Overall assessment

The diff restricts the Attic cache service to loopback (127.0.0.1:8081), removes LAN IPs from allowed-hosts, and disables the TCP/8081 firewall exception. These changes align with an architectural shift to route all ingress exclusively through a load-balanced HTTPS tunnel.

Blocking findings

None.

Important findings

None.

Suggestions

None.

Tests and validation

No configured deterministic checks.

Questions

Has the migration to the Newt client and load-balanced tunnel been fully validated across all existing clients before disabling direct LAN access?

Review limitations

Analysis is strictly limited to the provided diff. Live connectivity tests, firewall rule verification across the infrastructure, and validation of dependent services (e.g., Pangolin/Newt routing) were not performed.

Diff coverage

modules/services/atticd.nix: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
Commits considered: 1
Previous automated review: none found
Findings: 0

## Automated code review Reviewed commit: `e236ce9f7960a3ec9bd4fdf5c1afd76675a40e89` ## Verdict: Ready to merge No blocking or important findings were retained, and deterministic checks passed. Suggestions remain advisory. ### Overall assessment The diff restricts the Attic cache service to loopback (127.0.0.1:8081), removes LAN IPs from allowed-hosts, and disables the TCP/8081 firewall exception. These changes align with an architectural shift to route all ingress exclusively through a load-balanced HTTPS tunnel. ### Blocking findings None. ### Important findings None. ### Suggestions None. ### Tests and validation - No configured deterministic checks. ### Questions - Has the migration to the Newt client and load-balanced tunnel been fully validated across all existing clients before disabling direct LAN access? ### Review limitations - Analysis is strictly limited to the provided diff. Live connectivity tests, firewall rule verification across the infrastructure, and validation of dependent services (e.g., Pangolin/Newt routing) were not performed. ### Diff coverage - `modules/services/atticd.nix`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 1 - Previous automated review: none found - Findings: 0 </details>

nimmo commented

2026-08-10 19:23:40 +01:00

Author

Owner

Automated-review evidence:

Lyra native Newt is deployed; Pangolin reports both Attic targets healthy at 127.0.0.1:8081.
All repository-managed Nix clients use the shared https://attic.nimmog.uk/nixos substituter; no direct-LAN cache endpoint is configured.
Confirmed the public tunnel currently returns valid nix-cache-info (StoreDir: /nix/store, Priority: 41).

The direct listener is still present on the deployed generation, so the required final evidence is the documented one-backend canary after merging this PR, followed by the other backend and a no-op/public endpoint check.

Automated-review evidence: - Lyra native Newt is deployed; Pangolin reports both Attic targets healthy at `127.0.0.1:8081`. - All repository-managed Nix clients use the shared `https://attic.nimmog.uk/nixos` substituter; no direct-LAN cache endpoint is configured. - Confirmed the public tunnel currently returns valid `nix-cache-info` (`StoreDir: /nix/store`, `Priority: 41`). The direct listener is still present on the deployed generation, so the required final evidence is the documented one-backend canary after merging this PR, followed by the other backend and a no-op/public endpoint check.

nimmo merged commit 917d0dd47a into main

2026-08-10 19:49:31 +01:00

nimmo referenced this pull request from a commit

2026-08-10 19:49:31 +01:00

Merge pull request 'fix(attic): restrict cache backends to loopback' (#161) from issue-16-attic-loopback into main

nimmo deleted branch issue-16-attic-loopback

2026-08-10 19:49:32 +01:00

nimmo commented

2026-08-10 19:55:25 +01:00

Author

Owner

Final deployment evidence: both Attic Newt targets are now healthy at 127.0.0.1:8081 after the Vega and Lyra activations. The public https://attic.nimmog.uk/nixos/nix-cache-info endpoint remained reachable throughout the canary, and Vega confirmed Attic listening only on loopback. This completes the Attic portion of #16; the issue remains open for the broader network-exposure posture work.

Final deployment evidence: both Attic Newt targets are now healthy at `127.0.0.1:8081` after the Vega and Lyra activations. The public `https://attic.nimmog.uk/nixos/nix-cache-info` endpoint remained reachable throughout the canary, and Vega confirmed Attic listening only on loopback. This completes the Attic portion of #16; the issue remains open for the broader network-exposure posture work.