my nixos setup https://git.hwebs.info/nixos-config/atom?h=kusanagi-ollama-lan-firewall 2026-08-04T22:05:42Z 2026-08-04T22:05:42Z yokai accounts.8ef6c@simplelogin.com 2026-08-04T22:05:42Z urn:sha1:a7adbd5063fe7ab428d8174cb9b31bec2c6133d6 Let the shared LAN discovery module use each host's Wi-Fi interface instead of assuming kusanagi's wlp8s0 everywhere. Set kusanagi to wlp8s0 and enzo to wlp1s0. Reuse the same setting for kusanagi's Ollama LAN firewall rule so the service opening stays tied to the declared LAN interface. Assisted-by: OpenAI:gpt-5 2026-08-04T21:58:39Z yokai accounts.8ef6c@simplelogin.com 2026-08-04T21:58:39Z urn:sha1:b47ca1475decf1a98f10231f0cbeebfb75e7f6ea Move ping and Avahi/mDNS configuration into a shared LAN discovery module so kusanagi and enzo both publish their .local names, resolve each other on the LAN, and answer ping. Keep mDNS scoped to the shared Wi-Fi interface instead of using Avahi's global firewall helper. Assisted-by: OpenAI:gpt-5 2026-08-04T21:45:39Z yokai accounts.8ef6c@simplelogin.com 2026-08-04T21:45:39Z urn:sha1:ab57d8eae597938e63f06ff9b356548bcd8ce0bd Advertise kusanagi.local via Avahi on the Wi-Fi interface so LAN clients can use a stable local name instead of the current IP address. Keep Avahi's firewall hole scoped to wlp8s0 by disabling the module's global openFirewall helper and opening UDP 5353 on that interface explicitly. Assisted-by: OpenAI:gpt-5 2026-08-04T21:31:11Z yokai accounts.8ef6c@simplelogin.com 2026-08-04T21:31:11Z urn:sha1:04889e646cc83865ac1da1cdfc42e5a956c2cf30 Bind Ollama on all interfaces but open its API only on kusanagi's Wi-Fi interface, so LAN clients can reach it without relying on Tailscale exposure. Remove the blanket tailscale0 trust from the shared firewall so tailnet traffic follows explicit host firewall rules instead of inheriting access to every listening service. Assisted-by: OpenAI:gpt-5 2026-08-04T21:05:20Z Henry J Webster hwebs@hwebs.info 2026-08-04T05:02:54Z urn:sha1:df960b2ed92f9e45fc4984d19ab65c55074bb1d7 The 12B model at 32k context uses only 7.7 GB of the 7900 XT's 20 GB, so there is ample VRAM headroom for 64k with the q8_0 KV cache — agentic coding tools are context-hungry and 32k is the practical bottleneck. The keep-alive stops the default 5-minute idle unload from adding a reload stall to every resumed session on a single-user workstation. Update flake to get newer packages. Assisted-by: Claude Code:claude-fable-5 2026-08-04T03:51:26Z Henry J. Webster hwebs@hwebs.info 2026-08-04T03:51:26Z urn:sha1:9acf89a3af3fd4c354fcd887397b0c035bb21494 The recurring "ollama runs 100% on CPU" regressions were a boot-order race, not a gfx-target mismatch: ollama.service only ordered after network.target, and at boot it started between /dev/kfd and the 7900 XT's render node appearing. ollama probes GPUs once at startup, found none, and silently fell back to CPU until the next manual restart — which is why the previous HSA_OVERRIDE_GFX_VERSION commit "worked": the deploy restarted the service on a long-running system, and the restart was the actual cure. The card is a 7900 XT (Navi 31), natively gfx1100 — verified that discovery with no overrides finds it fine and drops only the unsupported Raphael iGPU (gfx1036). Remove HSA_OVERRIDE_GFX_VERSION and HIP_VISIBLE_DEVICES (ollama itself warns overriding visible devices can break discovery). Real fix: systemd-tag the kfd/renderD* char devices via udev (they get no device units otherwise) and order ollama after them, so discovery only runs once the GPU exists. Assisted-by: claude-code:claude-fable-5 2026-08-04T03:12:32Z Henry J. Webster hwebs@hwebs.info 2026-08-04T03:00:49Z urn:sha1:3df910d75fa98a7d0291e6b8c6889905c6088f64 Move the yokai agent-sandbox account (user, ikai group, /srv/git drop dir, scoped sudo de-escalation, and the local-clones workflow docs) out of machines/enzo into a shared profiles/sandbox.nix that both machines import. The only per-machine value is the human owner allowed to drop into the sandbox, exposed as a `sandbox.owner` string option so the profile stays username-agnostic (enzo: hwebs, kusanagi: henz). kusanagi gains the sandbox it didn't have before; enzo's inline block collapses to one setting. Assisted-by: claude-code:claude-opus-4-8 2026-08-04T02:39:51Z Henry J. Webster hwebs@hwebs.info 2026-08-04T02:38:08Z urn:sha1:71e36370770acc7498748a890cd0365b3d351027 The RDNA3 card reports as gfx1101/gfx1102/gfx11-generic, which the ROCm build bundled with ollama-rocm has no kernels for, so ollama found no usable device and ran 100% on CPU after the nixpkgs bump. Force it to present as gfx1100 via HSA_OVERRIDE_GFX_VERSION. Also set OLLAMA_FLASH_ATTENTION=1 so the existing q8_0 KV cache actually engages instead of silently falling back to f16 and inflating VRAM use. Assisted-by: Claude-code:Opus-4.8 2026-08-03T18:01:21Z Henry J. Webster hwebs@hwebs.info 2026-08-03T17:59:24Z urn:sha1:9ca21e94b8ade285e749d54441c7d9115da5b522 - replace x-clip with wl-clipboard for wayland machines - add TODOs I noticed while editing Assisted-by: Claude Code:claude-opus-4-8 2026-08-01T15:18:25Z Henry J. Webster hwebs@hwebs.info 2026-08-01T15:16:21Z urn:sha1:eb80a670dfcc78afd2a9459eb5515027b78cc736 Assisted-by: Claude:Opus-4.8