diff --git a/2configs/home/ham/nginx.nix b/2configs/home/ham/nginx.nix
index 2048ff2..e166b2a 100644
--- a/2configs/home/ham/nginx.nix
+++ b/2configs/home/ham/nginx.nix
@@ -6,5 +6,10 @@ in {
     serverAliases = [ "hass.lan" "ha" "ha.lan" ];
     locations."/".proxyPass = "http://localhost:8123";
     locations."/".proxyWebsockets = true;
+    extraConfig = ''
+      if ( $server_addr != "${internal-ip}" ) {
+        return 403;
+      }
+    '';
   };
 }