fix(ai): bind the nvidia GPU exporter to the static LAN IPv4

The 2026-10-22 audit found the live socket on *:9835: #373 bound
node/smartctl in monitoring.nix, but the nvidia exporter enabled in
hardware-nvidia.nix kept the nixpkgs default, so the socket-level
defence-in-depth layer never existed for 9835.

Extend the security-exporters eval check to every enabled exporter's
listenAddress so a future exporter without a bind fails the test.

Assisted-by: DeepSeek Harness (gpt-6-astra)

hosts/idols-ai/hardware-nvidia.nix

@@ -1,6 +1,7 @@
 {
   config,
   pkgs,
+  myvars,
   ...
 }:
 {
@@ -72,7 +73,12 @@
   # GPU monitoring: CUDA btop, nvtop, and the community nvidia_gpu_exporter.
   modules.btop.package = pkgs.btop-cuda;
   environment.systemPackages = [ pkgs.nvtopPackages.full ];
-  services.prometheus.exporters.nvidia-gpu.enable = true;
+  # LAN-bound like node/smartctl in modules/nixos/base/monitoring.nix: the
+  # socket must not exist on tailscale0/br0 even if the firewall regresses.
+  services.prometheus.exporters.nvidia-gpu = {
+    enable = true;
+    listenAddress = myvars.networking.hostsAddr.ai.ipv4;
+  };
 
   services.sunshine.settings = {
     max_bitrate = 20000; # in Kbps

outputs/x86_64-linux/tests/security-exporters/expected.nix

@@ -1,6 +1,7 @@
 { lib, outputs }:
 lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (_: {
   ipv4Restricted = true;
+  exportersBoundToLan = true;
   ipv6RestrictedBeforeTrust = true;
   generatedRestrictionsBeforeTrust = true;
   lanRetained = true;

outputs/x86_64-linux/tests/security-exporters/expr.nix

@@ -43,6 +43,18 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
           9835
           9633
         ];
+    # Every enabled exporter must bind this host's static LAN IPv4, not the
+    # nixpkgs default 0.0.0.0 (audit 2026-10-22 found the nvidia exporter wild).
+    exportersBoundToLan =
+      let
+        lanAddr = myvars.networking.hostsAddr.${config.networking.hostName}.ipv4 or null;
+        exporters = [
+          config.services.prometheus.exporters.node
+          config.services.prometheus.exporters.smartctl
+          config.services.prometheus.exporters.nvidia-gpu
+        ];
+      in
+      lib.all (e: !e.enable || e.listenAddress == lanAddr) exporters;
     ipv6RestrictedBeforeTrust = lib.hasInfix ipv6Guard beforeTrust;
     generatedRestrictionsBeforeTrust =
       broadTrustRules != [ ]