nixos: graphite, listen on localhost by default