diff options
| -rw-r--r-- | common/core.nix | 4 | ||||
| -rw-r--r-- | machines/kusanagi/default.nix | 5 |
2 files changed, 7 insertions, 2 deletions
diff --git a/common/core.nix b/common/core.nix index 5d36646..9e9ca7a 100644 --- a/common/core.nix +++ b/common/core.nix @@ -16,8 +16,8 @@ # Enable networking networking.networkmanager.enable = true; - # for tailscale - networking.firewall.trustedInterfaces = [ "tailscale0" ]; + # for tailscale; open only its discovery/connection UDP port and let the + # normal host firewall rules apply to tailnet traffic too. networking.firewall.allowedUDPPorts = [ 41641 ]; services.tailscale.enable = true; diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix index 1c8ccb1..a1d4610 100644 --- a/machines/kusanagi/default.nix +++ b/machines/kusanagi/default.nix @@ -19,6 +19,10 @@ networking.hostName = "kusanagi"; + # Ollama is served on the Wi-Fi LAN only. Tailscale remains governed by ACLs + # plus the host firewall because tailscale0 is not a trusted interface. + networking.firewall.interfaces.wlp8s0.allowedTCPPorts = [ 11434 ]; + # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It‘s perfectly fine and recommended to leave @@ -219,6 +223,7 @@ services.ollama = { enable = true; package = pkgs.ollama-rocm; + host = "0.0.0.0"; environmentVariables = { # No HIP_VISIBLE_DEVICES / HSA_OVERRIDE_GFX_VERSION: the 7900 XT is # native gfx1100 and discovery excludes the unsupported Raphael iGPU |