diff --git a/hosts/asusmini/default.nix b/hosts/asusmini/default.nix
index 116fc49..0a34b5f 100644
--- a/hosts/asusmini/default.nix
+++ b/hosts/asusmini/default.nix
@@ -97,6 +97,13 @@
 
   # Open ports in the firewall.
   networking.firewall.allowedTCPPorts = [ 22 80 443 ];
+  # Allow the CC edge (Caddy LXC on pve, 192.168.1.11) + LAN to reach the
+  # service ports directly; the public entry point moves off this box to
+  # 205.250.24.44 -> pve Caddy (see cc-ansible wiki / onboard plan).
+  # Tailnet traffic already bypasses this (tailscale0 not restricted).
+  networking.firewall.extraInputRules = ''
+    ip saddr 192.168.1.0/24 tcp dport { 5555, 5556, 6555, 3030 } accept
+  '';
   # networking.firewall.allowedUDPPorts = [ ... ];
   # Or disable the firewall altogether.
   # networking.firewall.enable = false;