diff options
| author | yokai <accounts.8ef6c@simplelogin.com> | 2026-08-04 16:31:11 -0500 |
|---|---|---|
| committer | yokai <accounts.8ef6c@simplelogin.com> | 2026-08-04 16:31:11 -0500 |
| commit | 04889e646cc83865ac1da1cdfc42e5a956c2cf30 (patch) | |
| tree | 552839771a3c4749299367f63bf6f4a7795d0cee /common | |
| parent | df960b2ed92f9e45fc4984d19ab65c55074bb1d7 (diff) | |
kusanagi/ollama: expose service on wifi LAN
Bind Ollama on all interfaces but open its API only on kusanagi's Wi-Fi interface, so LAN clients can reach it without relying on Tailscale exposure.
Remove the blanket tailscale0 trust from the shared firewall so tailnet traffic follows explicit host firewall rules instead of inheriting access to every listening service.
Assisted-by: OpenAI:gpt-5
Diffstat (limited to 'common')
| -rw-r--r-- | common/core.nix | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/common/core.nix b/common/core.nix index 5d36646..9e9ca7a 100644 --- a/common/core.nix +++ b/common/core.nix @@ -16,8 +16,8 @@ # Enable networking networking.networkmanager.enable = true; - # for tailscale - networking.firewall.trustedInterfaces = [ "tailscale0" ]; + # for tailscale; open only its discovery/connection UDP port and let the + # normal host firewall rules apply to tailnet traffic too. networking.firewall.allowedUDPPorts = [ 41641 ]; services.tailscale.enable = true; |