diff options
| -rw-r--r-- | common/lan-discovery.nix | 42 | ||||
| -rw-r--r-- | machines/enzo/default.nix | 1 | ||||
| -rw-r--r-- | machines/kusanagi/default.nix | 5 |
3 files changed, 32 insertions, 16 deletions
diff --git a/common/lan-discovery.nix b/common/lan-discovery.nix index f12971f..9341245 100644 --- a/common/lan-discovery.nix +++ b/common/lan-discovery.nix @@ -1,22 +1,36 @@ # LAN reachability and mDNS discovery shared by all machines. -{ ... }: +{ + config, + lib, + ... +}: +let + cfg = config.lanDiscovery; +in { - # Allow IPv4 ICMP echo requests so hosts can be found with ping. - networking.firewall.allowPing = true; + options.lanDiscovery.interface = lib.mkOption { + type = lib.types.str; + description = "Wi-Fi LAN interface used for mDNS discovery."; + }; + + config = { + # Allow IPv4 ICMP echo requests so hosts can be found with ping. + networking.firewall.allowPing = true; - # Avahi/mDNS: publish <hostname>.local and resolve other *.local LAN names. - # Keep the multicast DNS firewall opening scoped to the Wi-Fi LAN interface. - networking.firewall.interfaces.wlp8s0.allowedUDPPorts = [ 5353 ]; - services.avahi = { - enable = true; - nssmdns4 = true; - openFirewall = false; - allowInterfaces = [ "wlp8s0" ]; - publish = { + # Avahi/mDNS: publish <hostname>.local and resolve other *.local LAN names. + # Keep the multicast DNS firewall opening scoped to the host's Wi-Fi LAN interface. + networking.firewall.interfaces.${cfg.interface}.allowedUDPPorts = [ 5353 ]; + services.avahi = { enable = true; - addresses = true; - workstation = true; + nssmdns4 = true; + openFirewall = false; + allowInterfaces = [ cfg.interface ]; + publish = { + enable = true; + addresses = true; + workstation = true; + }; }; }; } diff --git a/machines/enzo/default.nix b/machines/enzo/default.nix index 3246ca3..c243a80 100644 --- a/machines/enzo/default.nix +++ b/machines/enzo/default.nix @@ -16,6 +16,7 @@ ]; networking.hostName = "enzo"; + lanDiscovery.interface = "wlp1s0"; # Set this to the NixOS release the laptop is first installed from, then # leave it. (See the comment in machines/kusanagi/default.nix.) diff --git a/machines/kusanagi/default.nix b/machines/kusanagi/default.nix index a1d4610..867a5eb 100644 --- a/machines/kusanagi/default.nix +++ b/machines/kusanagi/default.nix @@ -1,7 +1,7 @@ # kusanagi — AMD workstation. Everything here is specific to this machine: # ROCm/GPU, the Focusrite Scarlett audio interface, optical-disc archiving, the # NAS mounts, and the Kavita/Immich/Ollama servers. -{ pkgs, ... }: +{ config, pkgs, ... }: { imports = [ @@ -18,10 +18,11 @@ sandbox.owner = "henz"; networking.hostName = "kusanagi"; + lanDiscovery.interface = "wlp8s0"; # Ollama is served on the Wi-Fi LAN only. Tailscale remains governed by ACLs # plus the host firewall because tailscale0 is not a trusted interface. - networking.firewall.interfaces.wlp8s0.allowedTCPPorts = [ 11434 ]; + networking.firewall.interfaces.${config.lanDiscovery.interface}.allowedTCPPorts = [ 11434 ]; # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions |