networking: expose Ollama and mDNS on Wi-Fi LAN

Serve Ollama on kusanagi's Wi-Fi LAN while removing the blanket tailscale0 firewall trust so tailnet traffic follows explicit host firewall rules instead of inheriting every listening service.

Add shared LAN networking for both hosts: allow ping, publish and resolve .local names with Avahi, and scope mDNS to each machine's declared Wi-Fi interface.

Assisted-by: OpenAI:gpt-5

1 files changed, 36 insertions, 0 deletions

diff --git a/common/net.nix b/common/net.nix
new file mode 100644
index 0000000..9341245
--- /dev/null
+++ b/common/net.nix
@@ -0,0 +1,36 @@
+# LAN reachability and mDNS discovery shared by all machines.
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.lanDiscovery;
+in
+{
+  options.lanDiscovery.interface = lib.mkOption {
+    type = lib.types.str;
+    description = "Wi-Fi LAN interface used for mDNS discovery.";
+  };
+
+  config = {
+    # Allow IPv4 ICMP echo requests so hosts can be found with ping.
+    networking.firewall.allowPing = true;
+
+    # Avahi/mDNS: publish <hostname>.local and resolve other *.local LAN names.
+    # Keep the multicast DNS firewall opening scoped to the host's Wi-Fi LAN interface.
+    networking.firewall.interfaces.${cfg.interface}.allowedUDPPorts = [ 5353 ];
+    services.avahi = {
+      enable = true;
+      nssmdns4 = true;
+      openFirewall = false;
+      allowInterfaces = [ cfg.interface ];
+      publish = {
+        enable = true;
+        addresses = true;
+        workstation = true;
+      };
+    };
+  };
+}