diff --git a/flake.lock b/flake.lock
index 0ff7b12..9349754 100644
--- a/flake.lock
+++ b/flake.lock
@@ -288,11 +288,11 @@
         "sqlite-lib-src": "sqlite-lib-src"
       },
       "locked": {
-        "lastModified": 1751894783,
-        "narHash": "sha256-kVsDo+VW3eOJFwRGUept/ik+o9qN8MJY0m+ijDaL/BY=",
+        "lastModified": 1751902881,
+        "narHash": "sha256-eHew7tldSi2Q1z6/K1sUAtpBTP1j5LjSdeQT5ULne14=",
         "ref": "refs/heads/master",
-        "rev": "2d6f048f4a81ab5a542d18029a54d342a2c5b47e",
-        "revCount": 881,
+        "rev": "10b3b561c4c6e100f668da93ec48bbd968f4b453",
+        "revCount": 882,
         "type": "git",
         "url": "https://tangled.sh/@tangled.sh/core"
       },
diff --git a/hosts/nixery/configuration.nix b/hosts/nixery/configuration.nix
index 50e6529..b683785 100644
--- a/hosts/nixery/configuration.nix
+++ b/hosts/nixery/configuration.nix
@@ -24,7 +24,7 @@
       server = {
         owner = "did:plc:hwevmowznbiukdf6uk5dwrrq";
         hostname = "spindle.tangled.sh";
-        listenAddr = "0.0.0.0:6555";
+        listenAddr = "127.0.0.1:6555";
       };
     };
   };
diff --git a/hosts/nixery/services/nginx.nix b/hosts/nixery/services/nginx.nix
index 5a12f15..e3d78fe 100644
--- a/hosts/nixery/services/nginx.nix
+++ b/hosts/nixery/services/nginx.nix
@@ -1,11 +1,35 @@
 {
   services.nginx = {
     enable = true;
-    virtualHosts."nixery.tangled.sh" = {
-      addSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://localhost:8080";
+    virtualHosts = {
+      "nixery.tangled.sh" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:8080";
+          extraConfig = ''
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+          '';
+        };
+      };
+      "spindle.tangled.sh" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://localhost:6555";
+        };
+        locations."/events" = {
+          proxyPass = "http://localhost:6555";
+          extraConfig = ''
+            proxy_set_header X-Forwarded-For $remote_addr;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection Upgrade;
+          '';
+        };
       };
     };
   };