Publish
Optional. If you want the public internet to hit a process on your VM, declare it in git.
# user-vms/you.nix
publish = [
{ port = 3000; } # → https://you.tharavad.xyz
# { subdomain = "blog"; port = 8080; } # → https://blog.tharavad.xyz
]; After rebuild, the front door routes that hostname to your guest port over HTTPS (Let's Encrypt on edge). You still have to run something that listens plain HTTP inside the guest — TLS terminates at the door:
python3 -m http.server 3000 --bind 0.0.0.0
No process on the port means a proxy error, not a broken DNS entry. SSH and the web share the same names on different ports: twenty-two for shell, four-forty-three for the public web path (eighty redirects).
This is not a PaaS with auto deploys. It is a pipe you control. Keep it small, or make it weird. Both are allowed. Why the padlock came back: Back to HTTPS.