semi-spread example: serve internal vhosts on the VPN addresses only, over IPv4 and IPv6

docs/examples/semi-spread/swarm-central.nix

@@ -1,6 +1,6 @@
 # swarm-central: the swarm controller (and the swarm UI it serves) and the
 # secret store.
-{ config, ... }:
+{ config, lib, ... }:
 let
   mesh = import ./mesh.nix;
   hyperhive = config.services.hyperhive;
@@ -14,8 +14,13 @@ in
     # and hives on other machines.
     deploy.bao.extraListenAddresses = [ mesh.swarm-central.address ];
 
-    # The swarm UI is public.
+    # The gateway's ports are open to everyone. The swarm UI is the one vhost
+    # that answers there; the store's browser UI answers on the private
+    # addresses only.
     gateway.openFirewall = true;
+    gateway.vhosts = lib.genAttrs [ hyperhive.swarm.bao.ui.domain ] (_: {
+      public = false;
+    });
   };
 
   # The store is reachable over the VPN only.