security: bind aquamarine metrics exporters to loopback

hosts/idols-aquamarine/postgresql.nix

@@ -121,7 +121,8 @@ in
 
   services.prometheus.exporters.postgres = {
     enable = true;
-    listenAddress = "0.0.0.0";
+    # loopback only: scraped by VictoriaMetrics on the same host
+    listenAddress = "127.0.0.1";
     port = 9187;
     user = "postgres-exporter";
     group = "postgres-exporter";

hosts/idols-aquamarine/proxy.nix

@@ -82,7 +82,8 @@
   # https://github.com/wi1dcard/v2ray-exporter
   services.prometheus.exporters.v2ray = {
     enable = true;
-    listenAddress = "0.0.0.0";
+    # loopback only: scraped by VictoriaMetrics on the same host
+    listenAddress = "127.0.0.1";
     port = 9153;
     openFirewall = false;
     v2rayEndpoint = "127.0.0.1:54321";

hosts/idols-aquamarine/sftpgo.nix

@@ -95,7 +95,8 @@ in
       # prometheus metrics
       telemetry = {
         bind_port = 10000;
-        bind_address = "0.0.0.0";
+        # loopback only: scraped by VictoriaMetrics on the same host
+        bind_address = "127.0.0.1";
         # auth_user_file = "";
       };
       # multi-factor authentication settings

outputs/x86_64-linux/tests/security-aquamarine-metrics/expected.nix

@@ -0,0 +1,9 @@
+{
+  lib,
+  outputs,
+}:
+{
+  v2rayExporter = "127.0.0.1";
+  pgExporter = "127.0.0.1";
+  sftpgoTelemetry = "127.0.0.1";
+}

outputs/x86_64-linux/tests/security-aquamarine-metrics/expr.nix

@@ -0,0 +1,12 @@
+{
+  lib,
+  outputs,
+}:
+let
+  aqua = outputs.nixosConfigurations.aquamarine.config;
+in
+{
+  v2rayExporter = aqua.services.prometheus.exporters.v2ray.listenAddress;
+  pgExporter = aqua.services.prometheus.exporters.postgres.listenAddress;
+  sftpgoTelemetry = aqua.services.sftpgo.settings.telemetry.bind_address;
+}