diff options
| author | yokai <accounts.8ef6c@simplelogin.com> | 2026-08-04 16:31:11 -0500 |
|---|---|---|
| committer | yokai <accounts.8ef6c@simplelogin.com> | 2026-08-04 16:31:11 -0500 |
| commit | 04889e646cc83865ac1da1cdfc42e5a956c2cf30 (patch) | |
| tree | 552839771a3c4749299367f63bf6f4a7795d0cee /machines | |
| parent | df960b2ed92f9e45fc4984d19ab65c55074bb1d7 (diff) | |
kusanagi/ollama: expose service on wifi LAN
Bind Ollama on all interfaces but open its API only on kusanagi's Wi-Fi interface, so LAN clients can reach it without relying on Tailscale exposure.
Remove the blanket tailscale0 trust from the shared firewall so tailnet traffic follows explicit host firewall rules instead of inheriting access to every listening service.
Assisted-by: OpenAI:gpt-5
Diffstat (limited to 'machines')
| -rw-r--r-- | machines/kusanagi/default.nix | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix index 1c8ccb1..a1d4610 100644 --- a/machines/kusanagi/default.nix +++ b/machines/kusanagi/default.nix @@ -19,6 +19,10 @@ networking.hostName = "kusanagi"; + # Ollama is served on the Wi-Fi LAN only. Tailscale remains governed by ACLs + # plus the host firewall because tailscale0 is not a trusted interface. + networking.firewall.interfaces.wlp8s0.allowedTCPPorts = [ 11434 ]; + # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave @@ -219,6 +223,7 @@ services.ollama = { enable = true; package = pkgs.ollama-rocm; + host = "0.0.0.0"; environmentVariables = { # No HIP_VISIBLE_DEVICES / HSA_OVERRIDE_GFX_VERSION: the 7900 XT is # native gfx1100 and discovery excludes the unsupported Raphael iGPU |