From c040338b8430380712cb57afb3b7ca2d118d104d Mon Sep 17 00:00:00 2001
From: Valentin <valentin@fricklerhandwerk.de>
Date: Mon, 26 Oct 2026 11:28:40 +0100
Subject: Überwachungsdienste nur noch lokal erreichbar
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Das reduziert die Angriffsfläche ein wenig.
---
 tharos/grafana.nix    | 1 -
 tharos/prometheus.nix | 3 ++-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tharos/grafana.nix b/tharos/grafana.nix
index 0c6fd4f..c75d05a 100644
--- a/tharos/grafana.nix
+++ b/tharos/grafana.nix
@@ -13,7 +13,6 @@
       {
         services.grafana = {
           enable = true;
-          openFirewall = true;
           settings = {
             server = {
               domain = "grafana.${self.domain}";
diff --git a/tharos/prometheus.nix b/tharos/prometheus.nix
index 48d7a85..4bcd5d0 100644
--- a/tharos/prometheus.nix
+++ b/tharos/prometheus.nix
@@ -6,9 +6,10 @@
       {
         services.prometheus = {
           enable = true;
+          listenAddress = "127.0.0.1";
           exporters.node = {
             enable = true;
-            openFirewall = true;
+            listenAddress = "127.0.0.1";
             enabledCollectors = [ ];
           };
           globalConfig.scrape_interval = "10s";
-- 
cgit v1.3.1