kami
50cc17f33a
The template said "drop into your nginx sites" but listened on the wildcard `listen 80;` with no allow/deny ACL, unlike the actual deployed hexis.kvmx.ru config which binds only to the WireGuard (10.42.0.1) and LAN (192.168.1.104) addresses with allow/deny all. Anyone following the template as written would expose these unauthenticated admin UIs to the open internet. Bind explicitly to those two addresses and add the matching ACL block, mirroring cmd/mavweb/nginx.conf which already does this correctly. Added a comment naming both addresses as host-specific so a deploy on a different box swaps the IPs instead of reverting to `listen 80` when the bind fails. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CGeSZxh1DCtRxmFVSYVGvJ