nixos-config/common/core.nix, branch kusanagi-ollama-lan-firewallmy nixos setuphttps://git.hwebs.info/nixos-config/atom?h=kusanagi-ollama-lan-firewall2026-08-04T21:58:39Zcommon: share LAN discovery settings2026-08-04T21:58:39Zyokaiaccounts.8ef6c@simplelogin.com2026-08-04T21:58:39Zurn:sha1:b47ca1475decf1a98f10231f0cbeebfb75e7f6ea
Move ping and Avahi/mDNS configuration into a shared LAN discovery module so kusanagi and enzo both publish their .local names, resolve each other on the LAN, and answer ping.
Keep mDNS scoped to the shared Wi-Fi interface instead of using Avahi's global firewall helper.
Assisted-by: OpenAI:gpt-5
networking: allow ping on shared firewall2026-08-04T21:47:47Zyokaiaccounts.8ef6c@simplelogin.com2026-08-04T21:47:47Zurn:sha1:c91e78758a36badda84226f6670d43075614055e
Enable ICMP echo requests in the shared firewall so both kusanagi and enzo can be reached with ping without punching any additional service ports.
Assisted-by: OpenAI:gpt-5
kusanagi/ollama: expose service on wifi LAN2026-08-04T21:31:11Zyokaiaccounts.8ef6c@simplelogin.com2026-08-04T21:31:11Zurn:sha1:04889e646cc83865ac1da1cdfc42e5a956c2cf30
Bind Ollama on all interfaces but open its API only on kusanagi's Wi-Fi interface, so LAN clients can reach it without relying on Tailscale exposure.
Remove the blanket tailscale0 trust from the shared firewall so tailnet traffic follows explicit host firewall rules instead of inheriting access to every listening service.
Assisted-by: OpenAI:gpt-5
Restructure into a multi-machine flake and add the enzo laptop2026-07-30T15:38:54ZHenry J. Websterhwebs@hwebs.info2026-07-30T15:38:54Zurn:sha1:11ba75e40728e8b5735c9c7cefc7af1631c942af
Split the single-host config into a shared minimal base plus opt-in
profiles, and add a second machine (enzo laptop) alongside kusanagi.
- flake: add mkMachine helper; declare nixosConfigurations.kusanagi and
.enzo; add the disko input; move overlays per-machine.
- common/: minimal base only (boot, networking, tailscale, locale, nix
settings, neovim editor). Old configuration.nix/programs.nix removed.
- profiles/: coarse opt-in bundles (desktop, dev, apps). kusanagi imports
all three and stays byte-for-byte identical to the running system.
- machines/kusanagi/: all workstation-only config (ROCm, Scarlett audio,
optical-disc archiving, NAS mounts, kavita/immich/ollama); hardware
config moved here unchanged. User stays 'henz'.
- machines/enzo/: new laptop. Declarative LUKS+btrfs via disko
(LVM-on-LUKS, TPM2+PIN unlock, zram + encrypted swap for
suspend-then-hibernate); its own minimal niri desktop with
playback-only audio (no rtkit/jack); user 'hwebs'.
Assisted-by: Claude:claude-opus-4-8