common: parameterize LAN discovery interfacekusanagi-ollama-lan-firewall

Let the shared LAN discovery module use each host's Wi-Fi interface instead of assuming kusanagi's wlp8s0 everywhere. Set kusanagi to wlp8s0 and enzo to wlp1s0.

Reuse the same setting for kusanagi's Ollama LAN firewall rule so the service opening stays tied to the declared LAN interface.

Assisted-by: OpenAI:gpt-5

3 files changed, 32 insertions, 16 deletions

diff --git a/common/lan-discovery.nix b/common/lan-discovery.nix
index f12971f..9341245 100644
--- a/common/lan-discovery.nix
+++ b/common/lan-discovery.nix
@@ -1,22 +1,36 @@
 # LAN reachability and mDNS discovery shared by all machines.
-{ ... }:
+{
+  config,
+  lib,
+  ...
+}:
 
+let
+  cfg = config.lanDiscovery;
+in
 {
-  # Allow IPv4 ICMP echo requests so hosts can be found with ping.
-  networking.firewall.allowPing = true;
+  options.lanDiscovery.interface = lib.mkOption {
+    type = lib.types.str;
+    description = "Wi-Fi LAN interface used for mDNS discovery.";
+  };
+
+  config = {
+    # Allow IPv4 ICMP echo requests so hosts can be found with ping.
+    networking.firewall.allowPing = true;
 
-  # Avahi/mDNS: publish <hostname>.local and resolve other *.local LAN names.
-  # Keep the multicast DNS firewall opening scoped to the Wi-Fi LAN interface.
-  networking.firewall.interfaces.wlp8s0.allowedUDPPorts = [ 5353 ];
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-    openFirewall = false;
-    allowInterfaces = [ "wlp8s0" ];
-    publish = {
+    # Avahi/mDNS: publish <hostname>.local and resolve other *.local LAN names.
+    # Keep the multicast DNS firewall opening scoped to the host's Wi-Fi LAN interface.
+    networking.firewall.interfaces.${cfg.interface}.allowedUDPPorts = [ 5353 ];
+    services.avahi = {
       enable = true;
-      addresses = true;
-      workstation = true;
+      nssmdns4 = true;
+      openFirewall = false;
+      allowInterfaces = [ cfg.interface ];
+      publish = {
+        enable = true;
+        addresses = true;
+        workstation = true;
+      };
     };
   };
 }
diff --git a/machines/enzo/default.nix b/machines/enzo/default.nix
index 3246ca3..c243a80 100644
--- a/machines/enzo/default.nix
+++ b/machines/enzo/default.nix
@@ -16,6 +16,7 @@
   ];
 
   networking.hostName = "enzo";
+  lanDiscovery.interface = "wlp1s0";
 
   # Set this to the NixOS release the laptop is first installed from, then
   # leave it. (See the comment in machines/kusanagi/default.nix.)
diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix
index a1d4610..867a5eb 100644
--- a/machines/kusanagi/default.nix
+++ b/machines/kusanagi/default.nix
@@ -1,7 +1,7 @@
 # kusanagi — AMD workstation. Everything here is specific to this machine:
 # ROCm/GPU, the Focusrite Scarlett audio interface, optical-disc archiving, the
 # NAS mounts, and the Kavita/Immich/Ollama servers.
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
 {
   imports = [
@@ -18,10 +18,11 @@
   sandbox.owner = "henz";
 
   networking.hostName = "kusanagi";
+  lanDiscovery.interface = "wlp8s0";
 
   # Ollama is served on the Wi-Fi LAN only. Tailscale remains governed by ACLs
   # plus the host firewall because tailscale0 is not a trusted interface.
-  networking.firewall.interfaces.wlp8s0.allowedTCPPorts = [ 11434 ];
+  networking.firewall.interfaces.${config.lanDiscovery.interface}.allowedTCPPorts = [ 11434 ];
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions