modules/core/caddy.nix

@@ -144,6 +144,24 @@ $HAVEN {
 }
 EOF
       fi
+
+      # ── RTL (LAN access) ────────────────────────────
+      cat >> /run/caddy/Caddyfile <<EOF
+
+:3051 {
+  reverse_proxy :3050
+  encode gzip zstd
+}
+EOF
+
+      # ── Mempool (LAN access) ────────────────────────
+      cat >> /run/caddy/Caddyfile <<EOF
+
+:60847 {
+  reverse_proxy :60845
+  encode gzip zstd
+}
+EOF
     '';
   };
 }

modules/core/sovran-hub.nix

@@ -42,7 +42,7 @@ let
       { name = "LND";                unit = "lnd.service";          type = "system"; icon = "lnd";          enabled = cfg.services.bitcoin;  category = "bitcoin-apps"; credentials = []; }
       { name = "Ride The Lightning"; unit = "rtl.service";          type = "system"; icon = "rtl";          enabled = cfg.services.bitcoin;  category = "bitcoin-apps"; credentials = [
         { label = "Tor Access"; file = "/var/lib/tor/onion/rtl/hostname"; prefix = "http://"; }
-        { label = "Local Network"; file = "/var/lib/secrets/internal-ip"; prefix = "http://"; suffix = ":3050"; }
+        { label = "Local Network"; file = "/var/lib/secrets/internal-ip"; prefix = "http://"; suffix = ":3051"; }
         { label = "Password"; file = "/etc/nix-bitcoin-secrets/rtl-password"; }
       ]; }
       { name = "BTCPayserver";       unit = "btcpayserver.service"; type = "system"; icon = "btcpayserver"; enabled = cfg.services.bitcoin;  category = "bitcoin-apps"; credentials = [
@@ -283,6 +283,6 @@ in
       };
     };
 
-    networking.firewall.allowedTCPPorts = [ 8937 ];
+    networking.firewall.allowedTCPPorts = [ 3051 8937 60847 ];
   };
 }

modules/mempool.nix

@@ -11,15 +11,4 @@ lib.mkIf config.sovran_systemsOS.features.mempool {
 
   nix-bitcoin.onionServices.mempool-frontend.enable = true;
 
-  services.caddy = {
-      virtualHosts = {
-          ":60847" = {
-              extraConfig = ''
-                  reverse_proxy :60845
-                  encode gzip zstd
-              '';
-          };
-      };
-  };
-
 }