semi-spread example: serve internal vhosts on the VPN addresses only, over IPv4 and IPv6

docs/examples/semi-spread/gateway.nix

@@ -0,0 +1,20 @@
+# Which addresses the gateway's private vhosts answer on: this machine's VPN
+# addresses (IPv4 and IPv6) and the hive bridge. Identical on every host.
+# Each machine's own file lists its private vhosts (`public = false`); a vhost
+# that stays `public` also answers on these addresses.
+#
+# The bridge is how this machine's own containers (agents, swarm services)
+# reach a name it serves: the hive's resolver answers it with the bridge
+# address.
+{ config, ... }:
+let
+  mesh = import ./mesh.nix;
+  me = mesh.${config.networking.hostName};
+in
+{
+  services.hyperhive.gateway.privateListenAddresses = [
+    me.address
+    me.address6
+    config.services.hyperhive.network.bridgeIp
+  ];
+}