diff --git a/hosts/web-01.cloonar.com/modules/victoriametrics.nix b/hosts/web-01.cloonar.com/modules/victoriametrics.nix
index 95963d2..7b8455d 100644
--- a/hosts/web-01.cloonar.com/modules/victoriametrics.nix
+++ b/hosts/web-01.cloonar.com/modules/victoriametrics.nix
@@ -5,6 +5,11 @@
 
   sops.secrets.victoria-nginx-password.owner = "nginx";
 
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 8428 ];
+  };
+
   services.nginx.virtualHosts."victoria-server.cloonar.com" = {
     forceSSL = true;
     enableACME = true;
diff --git a/utils/modules/victoriametrics/default.nix b/utils/modules/victoriametrics/default.nix
index 75e0c97..ed8e3d2 100644
--- a/utils/modules/victoriametrics/default.nix
+++ b/utils/modules/victoriametrics/default.nix
@@ -20,7 +20,7 @@ in {
     enable = true;
     after = ["network-online.target"];
     wantedBy = ["multi-user.target"];
-    script = "vmagent -promscrape.config=${configure_prom} -envflag.enable -remoteWrite.url=https://victoria-server.cloonar.com/api/v1/write";
+    script = "vmagent -promscrape.config=${configure_prom} -envflag.enable -remoteWrite.url=http://victoria-server.cloonar.com:8428/api/v1/write";
 
     serviceConfig = {
       EnvironmentFile=config.sops.secrets.victoria-agent-env.path;