networking: expose Ollama and mDNS on Wi-Fi LAN

Serve Ollama on kusanagi's Wi-Fi LAN while removing the blanket tailscale0 firewall trust so tailnet traffic follows explicit host firewall rules instead of inheriting every listening service.

Add shared LAN networking for both hosts: allow ping, publish and resolve .local names with Avahi, and scope mDNS to each machine's declared Wi-Fi interface.

Assisted-by: OpenAI:gpt-5

6 files changed, 47 insertions, 10 deletions

diff --git a/common/core.nix b/common/core.nix
index 5d36646..9e9ca7a 100644
--- a/common/core.nix
+++ b/common/core.nix
@@ -16,8 +16,8 @@
   # Enable networking
   networking.networkmanager.enable = true;
 
-  # for tailscale
-  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+  # for tailscale; open only its discovery/connection UDP port and let the
+  # normal host firewall rules apply to tailnet traffic too.
   networking.firewall.allowedUDPPorts = [ 41641 ];
   services.tailscale.enable = true;
 
diff --git a/common/default.nix b/common/default.nix
index 946b3a7..e5bffc0 100644
--- a/common/default.nix
+++ b/common/default.nix
@@ -5,5 +5,6 @@
 {
   imports = [
     ./core.nix
+    ./net.nix
   ];
 }
diff --git a/common/net.nix b/common/net.nix
new file mode 100644
index 0000000..9341245
--- /dev/null
+++ b/common/net.nix
@@ -0,0 +1,36 @@
+# LAN reachability and mDNS discovery shared by all machines.
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.lanDiscovery;
+in
+{
+  options.lanDiscovery.interface = lib.mkOption {
+    type = lib.types.str;
+    description = "Wi-Fi LAN interface used for mDNS discovery.";
+  };
+
+  config = {
+    # Allow IPv4 ICMP echo requests so hosts can be found with ping.
+    networking.firewall.allowPing = true;
+
+    # Avahi/mDNS: publish <hostname>.local and resolve other *.local LAN names.
+    # Keep the multicast DNS firewall opening scoped to the host's Wi-Fi LAN interface.
+    networking.firewall.interfaces.${cfg.interface}.allowedUDPPorts = [ 5353 ];
+    services.avahi = {
+      enable = true;
+      nssmdns4 = true;
+      openFirewall = false;
+      allowInterfaces = [ cfg.interface ];
+      publish = {
+        enable = true;
+        addresses = true;
+        workstation = true;
+      };
+    };
+  };
+}
diff --git a/machines/enzo/default.nix b/machines/enzo/default.nix
index 3246ca3..c243a80 100644
--- a/machines/enzo/default.nix
+++ b/machines/enzo/default.nix
@@ -16,6 +16,7 @@
   ];
 
   networking.hostName = "enzo";
+  lanDiscovery.interface = "wlp1s0";
 
   # Set this to the NixOS release the laptop is first installed from, then
   # leave it. (See the comment in machines/kusanagi/default.nix.)
diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix
index 1c8ccb1..867a5eb 100644
--- a/machines/kusanagi/default.nix
+++ b/machines/kusanagi/default.nix
@@ -1,7 +1,7 @@
 # kusanagi — AMD workstation. Everything here is specific to this machine:
 # ROCm/GPU, the Focusrite Scarlett audio interface, optical-disc archiving, the
 # NAS mounts, and the Kavita/Immich/Ollama servers.
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
 {
   imports = [
@@ -18,6 +18,11 @@
   sandbox.owner = "henz";
 
   networking.hostName = "kusanagi";
+  lanDiscovery.interface = "wlp8s0";
+
+  # Ollama is served on the Wi-Fi LAN only. Tailscale remains governed by ACLs
+  # plus the host firewall because tailscale0 is not a trusted interface.
+  networking.firewall.interfaces.${config.lanDiscovery.interface}.allowedTCPPorts = [ 11434 ];
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
@@ -219,6 +224,7 @@
   services.ollama = {
     enable = true;
     package = pkgs.ollama-rocm;
+    host = "0.0.0.0";
     environmentVariables = {
       # No HIP_VISIBLE_DEVICES / HSA_OVERRIDE_GFX_VERSION: the 7900 XT is
       # native gfx1100 and discovery excludes the unsupported Raphael iGPU
diff --git a/machines/kusanagi/desktop.nix b/machines/kusanagi/desktop.nix
index c865844..44b9c81 100644
--- a/machines/kusanagi/desktop.nix
+++ b/machines/kusanagi/desktop.nix
@@ -22,13 +22,6 @@
     drivers = with pkgs; [ gutenprint ];
   };
 
-  # mDNS: printer discovery, and resolves kusanagi's *.local NAS names.
-  services.avahi = {
-    enable = true;
-    nssmdns4 = true;
-    openFirewall = true;
-  };
-
   # prevent auto-mounting optical disks
   services.udisks2.enable = true;