diff options
| author | Henry J. Webster <hwebs@hwebs.info> | 2026-08-04 17:10:10 -0500 |
|---|---|---|
| committer | Henry J. Webster <hwebs@hwebs.info> | 2026-08-04 17:14:09 -0500 |
| commit | a4c50351f5d55438a102d48c63dcbb62f9ef5e8d (patch) | |
| tree | d52b4c970e607bd9cb30c98acc8d0f7d6ebbcdba /common/core.nix | |
| parent | df960b2ed92f9e45fc4984d19ab65c55074bb1d7 (diff) | |
networking: expose Ollama and mDNS on Wi-Fi LAN
Serve Ollama on kusanagi's Wi-Fi LAN while removing the blanket tailscale0 firewall trust so tailnet traffic follows explicit host firewall rules instead of inheriting every listening service.
Add shared LAN networking for both hosts: allow ping, publish and resolve .local names with Avahi, and scope mDNS to each machine's declared Wi-Fi interface.
Assisted-by: OpenAI:gpt-5
Diffstat (limited to 'common/core.nix')
| -rw-r--r-- | common/core.nix | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/common/core.nix b/common/core.nix index 5d36646..9e9ca7a 100644 --- a/common/core.nix +++ b/common/core.nix @@ -16,8 +16,8 @@ # Enable networking networking.networkmanager.enable = true; - # for tailscale - networking.firewall.trustedInterfaces = [ "tailscale0" ]; + # for tailscale; open only its discovery/connection UDP port and let the + # normal host firewall rules apply to tailnet traffic too. networking.firewall.allowedUDPPorts = [ 41641 ]; services.tailscale.enable = true; |