diff --git a/host-specific/misaki/networking.nix b/host-specific/misaki/networking.nix
index 4718208..a55e803 100644
--- a/host-specific/misaki/networking.nix
+++ b/host-specific/misaki/networking.nix
@@ -102,8 +102,6 @@
       564
       # Misc development
       3000
-      # Victoria Traces
-      10428
       # Victoria Logs
       9428
       # Syncthing GUI
diff --git a/host-specific/misaki/services.nix b/host-specific/misaki/services.nix
index e2f0ddc..d0e050a 100644
--- a/host-specific/misaki/services.nix
+++ b/host-specific/misaki/services.nix
@@ -591,6 +591,11 @@
     owner = "root";
     group = "root";
   };
+  age.secrets.victoriatraces-write-pass = {
+    file = ../../secrets/victoriatraces-write-pass.age;
+    owner = "root";
+    group = "root";
+  };
   services.victorialogs = {
     enable = true;
     basicAuthUsername = "noah";
@@ -599,10 +604,16 @@
 
   services.victoriatraces = {
     enable = true;
-    basicAuthUsername = "noah";
-    basicAuthPasswordFile = config.age.secrets.victoriapass.path;
+    listenAddress = "127.0.0.1:10428";
   };
 
+  system.activationScripts.nginx-victoriatraces-htpasswd = ''
+    mkdir -p /var/lib/nginx
+    ${pkgs.apacheHttpd}/bin/htpasswd -nbB noah "$(cat ${config.age.secrets.victoriapass.path})" > /var/lib/nginx/victoriatraces.htpasswd
+    ${pkgs.apacheHttpd}/bin/htpasswd -nbB noah "$(cat ${config.age.secrets.victoriapass.path})" > /var/lib/nginx/victoriatraces-insert.htpasswd
+    ${pkgs.apacheHttpd}/bin/htpasswd -nbB publisher "$(cat ${config.age.secrets.victoriatraces-write-pass.path})" >> /var/lib/nginx/victoriatraces-insert.htpasswd
+  '';
+
   # Litterbox, collect my IRC logs
   systemd = {
     services = {
@@ -818,16 +829,21 @@
     };
     virtualHosts."traces.ngp.computer" = {
       http2 = true;
+      extraConfig = ''
+        allow 192.168.0.0/16;
+        allow 10.0.0.0/8;
+        allow 172.16.0.0/12;
+        allow 127.0.0.1;
+        allow ::1;
+        deny all;
+      '';
       locations."/" = {
         proxyPass = "http://localhost:10428/";
-        extraConfig = ''
-          allow 192.168.0.0/16;
-          allow 10.0.0.0/8;
-          allow 172.16.0.0/12;
-          allow 127.0.0.1;
-          allow ::1;
-          deny all;
-        '';
+        basicAuthFile = "/var/lib/nginx/victoriatraces.htpasswd";
+      };
+      locations."/insert/" = {
+        proxyPass = "http://localhost:10428/";
+        basicAuthFile = "/var/lib/nginx/victoriatraces-insert.htpasswd";
       };
     };
 
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index e1d9d86..3da82ac 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -30,6 +30,7 @@ in
   "garage_admin_secret.age".publicKeys = [ misaki ] ++ noah;
   "garage_metrics_secret.age".publicKeys = [ misaki ] ++ noah;
   "victoria-secret.age".publicKeys = [ misaki ] ++ noah;
+  "victoriatraces-write-pass.age".publicKeys = [ misaki ] ++ noah;
   "obsidian-auth-token.age".publicKeys = [ misaki ] ++ noah;
   "pocket-id-encryption-key.age".publicKeys = [ misaki ] ++ noah;
   "coder-client-secret.age".publicKeys = [ odin ] ++ noah;
diff --git a/secrets/victoriatraces-write-pass.age b/secrets/victoriatraces-write-pass.age
new file mode 100644
index 0000000000000000000000000000000000000000..cc1c0b28c672be404b4fa7a0b8a347e6536f39b6
GIT binary patch
literal 559
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSnHLEJLNLO$+2yib6
zsj^6Rt<(<*E%gg?vJA`gDUHZ64G(qC@NjV~O7^J?2`Nl8j^ql7$o4XJ_4BJpEcFhE
zN)9$JibzVT$jEUD(hqkJ@u`e*Npf{|Pb!KsO-8pZ&?za^w_HI#xk}r$AT>YREyXa`
zAm882*C*Gr+{xd~xWdP<I6G9|!Z<WECnYpIIFc*9DkCG@G19|5$1JzRD9t~l%rG-I
z$jHpG(5=$AJjc~HI5ao3s#v=y*aF?Q@G^tYqH=}uWQ)L(#K0nVL&I#xd}l|)RQH^e
z{DR6PbD!|MoTBvX#EOE-4EOvn$8s*?f@HUnfE0^}OpAho;B@oU+*CuS5)*%uWc{%6
z(CqMZM~ev4P|w_`C`Sz2!u*^g92JTp&9f3CUA%JwvyC$Ik}O@zQ@lNjqMSSe1GQb9
z@|>MY%d&!UauZElEx1h0sw$oRlOrq53d@QNO%qL>%bil3%_4o%gPpv50-QtgErWfX
zGt&yf0=aZ`brmcu!^6uX_1#Odic_O<oZNFu3o4^L4br?qP24S<oU}7sT^tRI+%wF>
zvbpjvl_b0nDU&@G-nsMJJp+a-!s09|J>)#fme^>#nfqbMjOPM7*_0$cJ@YvFNr3-L
GfENJsXS!<u

literal 0
HcmV?d00001