semi-spread example: serve internal vhosts on the VPN addresses only, over IPv4 and IPv6

docs/examples/semi-spread/swarm-services.nix

@@ -19,9 +19,22 @@ in
     # Everything once-per-swarm that is not placed elsewhere below.
     deploy.allSwarmServices = true;
 
-    # The forge and the matrix homeserver are public, and so is the SSO login
-    # they send browsers to.
+    # The gateway's ports are open to everyone. The forge and the matrix
+    # homeserver answer there, and so does the SSO login they send browsers
+    # to. Every other vhost here answers on the private addresses only.
     gateway.openFirewall = true;
+    gateway.vhosts =
+      lib.genAttrs
+        (with hyperhive.swarm; [
+          nats.domain
+          otel.domain
+          grafana.domain
+          victoriametrics.domain
+          victorialogs.domain
+        ])
+        (_: {
+          public = false;
+        });
 
     deploy.bao = lib.mergeAttrsList [
       { enable = false; }