fix(vault01/victorialogs): listen netbird & aps

machines/nixos/vault01/monitoring/victorialogs.nix

@@ -2,21 +2,36 @@
 #
 # SPDX-License-Identifier: EUPL-1.2
 
+{ meta, ... }:
+
 let
   port = 9428;
 in
 
 {
-  services.victorialogs = {
-    enable = true;
+  services = {
+    nginx = {
+      enable = true;
+      streamConfig = ''
+        server {
+          listen 10.0.253.1:${toString port};
+          listen ${meta.network.vault01.netbirdIp}:${toString port};
+          proxy_pass 127.0.0.1:${toString port};
+        }
+      '';
+    };
+    victorialogs = {
+      enable = true;
 
-    flags = {
-      retentionPeriod = "52w";
-      # FIXME: We need to listen so that we are available for both the APs and the grafana
-      httpListenAddr = "0.0.0.0:${builtins.toString port}";
+      flags = {
+        retentionPeriod = "52w";
+        httpListenAddr = "127.0.0.1:${builtins.toString port}";
+      };
     };
   };
 
-  # FIXME: @catvayor please do a nft rule to open the firewall on the AP-facing interfaces
-  networking.firewall.interfaces.wt0.allowedTCPPorts = [ port ];
+  networking.firewall.interfaces = {
+    wt0.allowedTCPPorts = [ port ];
+    vlan-admin-ap.allowedTCPPorts = [ port ];
+  };
 }