# Node exporter on tailscale0 only. openFirewall stays false (that hole is LAN-wide).
{ ... }:
{
  services.prometheus.exporters.node = {
    enable = true;
    port = 9100;
    listenAddress = "0.0.0.0";
    enabledCollectors = [ "systemd" ];
    extraFlags = [
      "--collector.systemd.enable-restarts-metrics"
      "--collector.systemd.unit-include=(llama-server|llama-vision)[.]service"
    ];
    openFirewall = false;
  };

  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 9100 ];
}