prowlarr: allow tailscale

hosts/architect/prowlarr.nix

@@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, ... }:
 
 let
   domain = "htpro.giugl.io";
@@ -6,13 +6,18 @@ in
 {
   services.prowlarr.enable = true;
 
-  architect.vhost.${domain} = {
+  architect.vhost.${domain} = with config.architect.networks; {
     dnsInterfaces = [ "tailscale" ];
 
     locations."/" = {
       port = 9696;
       allowLan = true;
+
+      allow = [
+        tailscale.net
+      ];
     };
+
   };
 
   users.groups.media.members = [ "prowlarr" ];