Lock down deploy/ecosystem/nginx.conf template to match the live host

The template said "drop into your nginx sites" but listened on the
wildcard `listen 80;` with no allow/deny ACL, unlike the actual deployed
hexis.kvmx.ru config which binds only to the WireGuard (10.42.0.1) and
LAN (192.168.1.104) addresses with allow/deny all. Anyone following the
template as written would expose these unauthenticated admin UIs to the
open internet.

Bind explicitly to those two addresses and add the matching ACL block,
mirroring cmd/mavweb/nginx.conf which already does this correctly.
Added a comment naming both addresses as host-specific so a deploy on a
different box swaps the IPs instead of reverting to `listen 80` when the
bind fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CGeSZxh1DCtRxmFVSYVGvJ

deploy/ecosystem/nginx.conf

@@ -4,10 +4,23 @@
 #
 # NOTE: hexis.<domain> previously pointed at the MCP tool — repoint that
 # elsewhere first (the app now owns hexis.*).
+#
+# 10.42.0.1 and 192.168.1.104 below are THIS BOX's WireGuard and LAN
+# addresses (homesrv) — these admin UIs have no auth of their own, so the
+# explicit bind + allow/deny below is what keeps them off the open internet.
+# On a different box, replace both addresses with that box's wg and LAN IPs.
+# Do NOT "fix" a failed bind by reverting to `listen 80` (all interfaces) —
+# that removes the only access control these containers have.
 
 server {
-    listen 80;
+    listen 10.42.0.1:80;
+    listen 192.168.1.104:80;
     server_name nexus.kvmx.ru;
+
+    allow 10.42.0.0/24;
+    allow 192.168.1.0/24;
+    deny all;
+
     location / {
         proxy_pass http://127.0.0.1:9740;
         proxy_set_header Host $host;
@@ -18,8 +31,14 @@ server {
 }
 
 server {
-    listen 80;
+    listen 10.42.0.1:80;
+    listen 192.168.1.104:80;
     server_name praxis.kvmx.ru;
+
+    allow 10.42.0.0/24;
+    allow 192.168.1.0/24;
+    deny all;
+
     location / {
         proxy_pass http://127.0.0.1:8989;
         proxy_set_header Host $host;
@@ -30,8 +49,14 @@ server {
 }
 
 server {
-    listen 80;
+    listen 10.42.0.1:80;
+    listen 192.168.1.104:80;
     server_name hexis.kvmx.ru;
+
+    allow 10.42.0.0/24;
+    allow 192.168.1.0/24;
+    deny all;
+
     location / {
         proxy_pass http://127.0.0.1:9741;
         proxy_set_header Host $host;