nixos/graphite: listen on localhost by default