base/roowho2: traffic filter to PVV IP-space

base/services/roowho2.nix

@@ -1,4 +1,12 @@
-{ ... }:
+{ lib, values, ... }:
 {
-  services.roowho2.enable = true;
+  services.roowho2.enable = lib.mkDefault true;
+
+  systemd.sockets.roowho2-rwhod.socketConfig = {
+    IPAddressDeny = "any";
+    IPAddressAllow = [
+      "127.0.0.1"
+      values.ipv4-space
+    ];
+  };
 }

flake.lock

@@ -393,11 +393,11 @@
         "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1767631532,
-        "narHash": "sha256-cDUHAGjfkH3G/lxXhfEzHOZrt8JDSGOGa2M25jJtrMg=",
+        "lastModified": 1767669800,
+        "narHash": "sha256-b1r1VSDBTRuxYHZVV4his8KhafAqNcWlAZBLOX1UORg=",
         "ref": "main",
-        "rev": "fa789c43a667f50c14fa8238c51af5bcd7ab5aa7",
-        "revCount": 26,
+        "rev": "369d37513c85855751f406191fbd493a2461f072",
+        "revCount": 33,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Projects/roowho2.git"
       },