From bce34985ebdd28a76b58a6328851a4f26ff2f04c Mon Sep 17 00:00:00 2001
From: DannyDannyDanny <dth@taiga.ai>
Date: Sat, 25 Apr 2026 13:15:59 +0200
Subject: [PATCH] =?UTF-8?q?feat(sunken-ship):=20open=20firewall=20:8080=20?=
 =?UTF-8?q?for=20bbbot=20via=20vps-relay=20=F0=9F=94=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 nixos/hosts/sunken-ship.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/hosts/sunken-ship.nix b/nixos/hosts/sunken-ship.nix
index a8b96bf..976baf5 100644
--- a/nixos/hosts/sunken-ship.nix
+++ b/nixos/hosts/sunken-ship.nix
@@ -73,9 +73,11 @@
     publish = { enable = true; userServices = true; };
   };
 
-  # Open firewall for AirPlay (mDNS + UxPlay default ports) + Navidrome.
+  # Open firewall for AirPlay (mDNS + UxPlay default ports) + Navidrome
+  # + bbbot HTTP backend (proxied by Caddy on vps-relay over ZT).
+  # TODO 4g: tighten to only the VPS's ZT IPv6 instead of any source.
   networking.firewall = {
-    allowedTCPPorts = [ 7000 7001 7100 4533 ];
+    allowedTCPPorts = [ 7000 7001 7100 4533 8080 ];
     allowedUDPPorts = [ 5353 6000 6001 7011 ];
   };