networking: expose Ollama and mDNS on Wi-Fi LAN

Serve Ollama on kusanagi's Wi-Fi LAN while removing the blanket tailscale0 firewall trust so tailnet traffic follows explicit host firewall rules instead of inheriting every listening service.

Add shared LAN networking for both hosts: allow ping, publish and resolve .local names with Avahi, and scope mDNS to each machine's declared Wi-Fi interface.

Assisted-by: OpenAI:gpt-5

1 files changed, 7 insertions, 1 deletions

diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix
index 1c8ccb1..867a5eb 100644
--- a/machines/kusanagi/default.nix
+++ b/machines/kusanagi/default.nix
@@ -1,7 +1,7 @@
 # kusanagi — AMD workstation. Everything here is specific to this machine:
 # ROCm/GPU, the Focusrite Scarlett audio interface, optical-disc archiving, the
 # NAS mounts, and the Kavita/Immich/Ollama servers.
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
 {
   imports = [
@@ -18,6 +18,11 @@
   sandbox.owner = "henz";
 
   networking.hostName = "kusanagi";
+  lanDiscovery.interface = "wlp8s0";
+
+  # Ollama is served on the Wi-Fi LAN only. Tailscale remains governed by ACLs
+  # plus the host firewall because tailscale0 is not a trusted interface.
+  networking.firewall.interfaces.${config.lanDiscovery.interface}.allowedTCPPorts = [ 11434 ];
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
@@ -219,6 +224,7 @@
   services.ollama = {
     enable = true;
     package = pkgs.ollama-rocm;
+    host = "0.0.0.0";
     environmentVariables = {
       # No HIP_VISIBLE_DEVICES / HSA_OVERRIDE_GFX_VERSION: the 7900 XT is
       # native gfx1100 and discovery excludes the unsupported Raphael iGPU