From a4c50351f5d55438a102d48c63dcbb62f9ef5e8d Mon Sep 17 00:00:00 2001 From: "Henry J. Webster" Date: Tue, 4 Aug 2026 17:10:10 -0500 Subject: networking: expose Ollama and mDNS on Wi-Fi LAN Serve Ollama on kusanagi's Wi-Fi LAN while removing the blanket tailscale0 firewall trust so tailnet traffic follows explicit host firewall rules instead of inheriting every listening service. Add shared LAN networking for both hosts: allow ping, publish and resolve .local names with Avahi, and scope mDNS to each machine's declared Wi-Fi interface. Assisted-by: OpenAI:gpt-5 --- common/core.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'common/core.nix') diff --git a/common/core.nix b/common/core.nix index 5d36646..9e9ca7a 100644 --- a/common/core.nix +++ b/common/core.nix @@ -16,8 +16,8 @@ # Enable networking networking.networkmanager.enable = true; - # for tailscale - networking.firewall.trustedInterfaces = [ "tailscale0" ]; + # for tailscale; open only its discovery/connection UDP port and let the + # normal host firewall rules apply to tailnet traffic too. networking.firewall.allowedUDPPorts = [ 41641 ]; services.tailscale.enable = true; -- cgit v1.3