diff --git a/homeserver/containers/audiobookshelf.nix b/homeserver/containers/audiobookshelf.nix
index 4026439..1195511 100644
--- a/homeserver/containers/audiobookshelf.nix
+++ b/homeserver/containers/audiobookshelf.nix
@@ -20,10 +20,12 @@
         "/var/data/audiobookshelf/config:/config:Z"
         "/var/mnt/bulk/Books/Audiobooks/metadata:/metadata:Z"
       ];
-      publishPorts = [ "13378:80" ];
+      publishPorts = [ "127.0.0.1:13378:80" ];
     };
     serviceConfig = {
       Restart = "always";
+      MemoryMax = "1G";
+      PidsLimit = "1024";
     };
   };
 }
diff --git a/homeserver/containers/jellyfin.nix b/homeserver/containers/jellyfin.nix
index 886a442..5d363e9 100644
--- a/homeserver/containers/jellyfin.nix
+++ b/homeserver/containers/jellyfin.nix
@@ -22,7 +22,7 @@
         PGID = "0";
         TZ = "Etc/UTC";
       };
-      networks = [ "host" ];
+      publishPorts = [ "127.0.0.1:8096:8096" ];
       volumes = [
         "/var/data/jellyfin/config:/config:z"
         "/var/data/jellyfin/cache:/cache:z"
@@ -32,6 +32,8 @@
     };
     serviceConfig = {
       Restart = "always";
+      MemoryMax = "6G";
+      PidsLimit = "4096";
     };
   };
 }
diff --git a/homeserver/containers/mox.nix b/homeserver/containers/mox.nix
index f22dcb6..9ebe26a 100644
--- a/homeserver/containers/mox.nix
+++ b/homeserver/containers/mox.nix
@@ -32,6 +32,8 @@
     };
     serviceConfig = {
       Restart = "on-failure";
+      MemoryMax = "1G";
+      PidsLimit = "1024";
     };
   };
 }
diff --git a/homeserver/containers/syncthing.nix b/homeserver/containers/syncthing.nix
index fa72f8e..1862033 100644
--- a/homeserver/containers/syncthing.nix
+++ b/homeserver/containers/syncthing.nix
@@ -25,13 +25,15 @@
       };
       volumes = [ "/var/data/syncthing/config:/var/syncthing:z" ];
       publishPorts = [
-        "3333:8384"
+        "127.0.0.1:3333:8384"
         "22000:22000/tcp"
         "22000:22000/udp"
       ];
     };
     serviceConfig = {
       Restart = "no";
+      MemoryMax = "512M";
+      PidsLimit = "1024";
     };
   };
 }
diff --git a/homeserver/containers/tranquil-pds.nix b/homeserver/containers/tranquil-pds.nix
index be61fff..c3bd564 100644
--- a/homeserver/containers/tranquil-pds.nix
+++ b/homeserver/containers/tranquil-pds.nix
@@ -39,6 +39,8 @@
     };
     serviceConfig = {
       Restart = "always";
+      MemoryMax = "2G";
+      PidsLimit = "2048";
     };
   };
   tranquil-pds-pds = {
@@ -63,6 +65,8 @@
     };
     serviceConfig = {
       Restart = "always";
+      MemoryMax = "1G";
+      PidsLimit = "1024";
     };
     unitConfig = {
       Requires = [ "tranquil-pds-db.service" ];
diff --git a/homeserver/nixos/configuration.nix b/homeserver/nixos/configuration.nix
index 364a97f..605e261 100644
--- a/homeserver/nixos/configuration.nix
+++ b/homeserver/nixos/configuration.nix
@@ -62,7 +62,9 @@ in
   # ── firewall: exactly the current public exposure, nothing stale ─────────
   networking.firewall.enable = true;
   networking.firewall.allowedTCPPorts = [ 22 25 80 443 465 993 22000 ];
-  networking.firewall.allowedUDPPorts = [ 22000 21027 41641 ];
+  # 21027 is gone: syncthing local discovery is disabled
+  # (localAnnounceEnabled=false), so nothing listens on the host.
+  networking.firewall.allowedUDPPorts = [ 22000 41641 ];
 
   # ── sudo: passwordless for the operator (matches FCOS `core` behavior; the
   #     box is behind the router + tailscale, ssh is key-only). Swap for a
@@ -96,8 +98,11 @@ in
     isNormalUser = true;
     extraGroups = [ "wheel" ];
     openssh.authorizedKeys.keys = [
-      # The key that was authorized for `core` on FCOS.
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4XW5qupX6DGeWpEM7yrJRCR1aXC4Tdq9WBLKD9mvj4 alexispurslane@pm.me"
+      # The key that was authorized for `core` on FCOS. from= restricts it to
+      # the tailnet (CGNAT 100.64.0.0/10) and the LAN: 22 stays public only
+      # for knot git-over-ssh, whose users authenticate via the
+      # AuthorizedKeysCommand and never use this key.
+      "from=\"100.64.0.0/10,192.168.1.0/24\" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4XW5qupX6DGeWpEM7yrJRCR1aXC4Tdq9WBLKD9mvj4 alexispurslane@pm.me"
     ];
   };
   # git user: uid/gid match the knot data ownership (1001:1002, created by
diff --git a/homeserver/nixos/nginx.nix b/homeserver/nixos/nginx.nix
index 33972d4..6ec25f7 100644
--- a/homeserver/nixos/nginx.nix
+++ b/homeserver/nixos/nginx.nix
@@ -144,11 +144,23 @@ in
       "mail.xenolandscapes.com" = {
         useACMEHost = "xenolandscapes.com";
         forceSSL = true;
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow 100.64.0.0/10;
+          allow fd7a:115c:a1e0::/48;
+          deny all;
+        '';
         locations."/".proxyPass = "http://127.0.0.1:10080";
       };
       "webmail.xenolandscapes.com" = {
         useACMEHost = "xenolandscapes.com";
         forceSSL = true;
+        extraConfig = ''
+          allow 127.0.0.1;
+          allow 100.64.0.0/10;
+          allow fd7a:115c:a1e0::/48;
+          deny all;
+        '';
         locations."/".proxyPass = "http://127.0.0.1:10080";
       };
     };
diff --git a/homeserver/nixos/services.nix b/homeserver/nixos/services.nix
index 55e3f1b..9509dce 100644
--- a/homeserver/nixos/services.nix
+++ b/homeserver/nixos/services.nix
@@ -38,6 +38,7 @@ in
       KNOT_SERVER_DB_PATH = "/var/data/knot/server/knotserver.db";
       KNOT_REPO_SCAN_PATH = "/var/data/knot/repositories";
       KNOT_SERVER_INTERNAL_LISTEN_ADDR = "127.0.0.1:5444";
+      KNOT_SERVER_LISTEN_ADDR = "127.0.0.1:5555";
       APPVIEW_ENDPOINT = "https://tangled.sh";
       SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
       TZDIR = "${pkgs.tzdata}/share/zoneinfo";
diff --git a/result b/result
index 13b3a6e..39de0d8 120000
--- a/result
+++ b/result
@@ -1 +1 @@
-/nix/store/amz4yqfmndqk22nmaxyav73491dcig0c-homeserver-deploy
\ No newline at end of file
+/nix/store/f07mwz51i7m4zn0ng863dxy90wkci95l-nixos-system-xenolandscapes-26.11.20260729.9bc0289
\ No newline at end of file