common: share LAN discovery settings

Move ping and Avahi/mDNS configuration into a shared LAN discovery module so kusanagi and enzo both publish their .local names, resolve each other on the LAN, and answer ping.

Keep mDNS scoped to the shared Wi-Fi interface instead of using Avahi's global firewall helper.

Assisted-by: OpenAI:gpt-5

5 files changed, 23 insertions, 24 deletions

diff --git a/common/core.nix b/common/core.nix
index c06069a..9e9ca7a 100644
--- a/common/core.nix
+++ b/common/core.nix
@@ -18,7 +18,6 @@
 
   # for tailscale; open only its discovery/connection UDP port and let the
   # normal host firewall rules apply to tailnet traffic too.
-  networking.firewall.allowPing = true;
   networking.firewall.allowedUDPPorts = [ 41641 ];
   services.tailscale.enable = true;
 
diff --git a/common/default.nix b/common/default.nix
index 946b3a7..e977351 100644
--- a/common/default.nix
+++ b/common/default.nix
@@ -5,5 +5,6 @@
 {
   imports = [
     ./core.nix
+    ./lan-discovery.nix
   ];
 }
diff --git a/common/lan-discovery.nix b/common/lan-discovery.nix
new file mode 100644
index 0000000..f12971f
--- /dev/null
+++ b/common/lan-discovery.nix
@@ -0,0 +1,22 @@
+# LAN reachability and mDNS discovery shared by all machines.
+{ ... }:
+
+{
+  # Allow IPv4 ICMP echo requests so hosts can be found with ping.
+  networking.firewall.allowPing = true;
+
+  # Avahi/mDNS: publish <hostname>.local and resolve other *.local LAN names.
+  # Keep the multicast DNS firewall opening scoped to the Wi-Fi LAN interface.
+  networking.firewall.interfaces.wlp8s0.allowedUDPPorts = [ 5353 ];
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    openFirewall = false;
+    allowInterfaces = [ "wlp8s0" ];
+    publish = {
+      enable = true;
+      addresses = true;
+      workstation = true;
+    };
+  };
+}
diff --git a/machines/enzo/default.nix b/machines/enzo/default.nix
index 86a05d3..3246ca3 100644
--- a/machines/enzo/default.nix
+++ b/machines/enzo/default.nix
@@ -58,14 +58,6 @@
     "hwebs"
   ];
 
-  # mDNS client: resolve *.local names on the LAN (kusanagi, NAS, etc.).
-  # Kusanagi already advertises via Avahi; this side just needs NSS
-  # resolution so kusanagi.local resolves without an SSH config hostname.
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-  };
-
   # Wifi is managed from the CLI (nmcli/nmtui); trim the rest.
   networking.modemmanager.enable = false; # no cellular modem
 
diff --git a/machines/kusanagi/desktop.nix b/machines/kusanagi/desktop.nix
index 8e1eb8c..44b9c81 100644
--- a/machines/kusanagi/desktop.nix
+++ b/machines/kusanagi/desktop.nix
@@ -22,21 +22,6 @@
     drivers = with pkgs; [ gutenprint ];
   };
 
-  # mDNS: publish kusanagi.local and resolve *.local LAN names.
-  # Keep the firewall opening scoped to the Wi-Fi LAN interface.
-  networking.firewall.interfaces.wlp8s0.allowedUDPPorts = [ 5353 ];
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-    openFirewall = false;
-    allowInterfaces = [ "wlp8s0" ];
-    publish = {
-      enable = true;
-      addresses = true;
-      workstation = true;
-    };
-  };
-
   # prevent auto-mounting optical disks
   services.udisks2.enable = true;