Locked down by default
One split does most of the work here: reading from the mirror is anonymous, and changing it is not. Every build host on your network needs the first and none of them needs the second, so they are separate privileges enforced separately.
Two planes
The routes your builds use are anonymous and read-only by design. That is not laxness: a mirror that a build cannot read without a credential is a mirror you now have to distribute credentials for, to every host, forever.
The control plane — prefetch, gc, artifact lifecycle, catalog, audit, status, backends, and the forge's repo management — is gated by a bearer token. The build coordinator has its OWN separate token, so a leaked mirror credential cannot queue a build, which is remote code execution on a build host by design.
With no token set at all the server runs in loopback dev mode, and it REFUSES to bind a non-loopback address that way. You cannot accidentally expose an ungated control plane to your network — the unsafe configuration is the one that will not start, rather than the one you had to remember to avoid.
Defence in depth
An optional IP allowlist applies to every request, not only to the control plane. Loopback is always permitted; a rejection returns 403 and writes an audit row.
Upstream TLS is verified explicitly on every backend's curl handle, with an optional custom CA bundle for an air-gapped trust store.
Off-LAN callers meet HTTP Basic on the vhost, per-device, pre-hashed — so revoking a lost phone is deleting a line.
What it costs
Stated plainly, because a claim with no stated cost is the one nobody re-checks.
The control plane is a bearer token, not a per-user identity: anything holding it can do anything it permits. Off-LAN that is fronted by per-device HTTP Basic, which is what makes revoking one device possible at all.