kusanagi/mdns: publish workstation on wifi LAN

Advertise kusanagi.local via Avahi on the Wi-Fi interface so LAN clients can use a stable local name instead of the current IP address.

Keep Avahi's firewall hole scoped to wlp8s0 by disabling the module's global openFirewall helper and opening UDP 5353 on that interface explicitly.

Assisted-by: OpenAI:gpt-5

1 files changed, 10 insertions, 2 deletions

diff --git a/machines/kusanagi/desktop.nix b/machines/kusanagi/desktop.nix
index c865844..8e1eb8c 100644
--- a/machines/kusanagi/desktop.nix
+++ b/machines/kusanagi/desktop.nix
@@ -22,11 +22,19 @@
     drivers = with pkgs; [ gutenprint ];
   };
 
-  # mDNS: printer discovery, and resolves kusanagi's *.local NAS names.
+  # mDNS: publish kusanagi.local and resolve *.local LAN names.
+  # Keep the firewall opening scoped to the Wi-Fi LAN interface.
+  networking.firewall.interfaces.wlp8s0.allowedUDPPorts = [ 5353 ];
   services.avahi = {
     enable = true;
     nssmdns4 = true;
-    openFirewall = true;
+    openFirewall = false;
+    allowInterfaces = [ "wlp8s0" ];
+    publish = {
+      enable = true;
+      addresses = true;
+      workstation = true;
+    };
   };
 
   # prevent auto-mounting optical disks