From c040338b8430380712cb57afb3b7ca2d118d104d Mon Sep 17 00:00:00 2001
From: Valentin <valentin@fricklerhandwerk.de>
Date: Mon, 26 Oct 2026 11:28:40 +0100
Subject: Überwachungsdienste nur noch lokal erreichbar
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Das reduziert die Angriffsfläche ein wenig.
---
 tharos/prometheus.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'tharos/prometheus.nix')

diff --git a/tharos/prometheus.nix b/tharos/prometheus.nix
index 48d7a85..4bcd5d0 100644
--- a/tharos/prometheus.nix
+++ b/tharos/prometheus.nix
@@ -6,9 +6,10 @@
       {
         services.prometheus = {
           enable = true;
+          listenAddress = "127.0.0.1";
           exporters.node = {
             enable = true;
-            openFirewall = true;
+            listenAddress = "127.0.0.1";
             enabledCollectors = [ ];
           };
           globalConfig.scrape_interval = "10s";
-- 
cgit v1.3.1