From 04889e646cc83865ac1da1cdfc42e5a956c2cf30 Mon Sep 17 00:00:00 2001 From: yokai Date: Tue, 4 Aug 2026 16:31:11 -0500 Subject: kusanagi/ollama: expose service on wifi LAN Bind Ollama on all interfaces but open its API only on kusanagi's Wi-Fi interface, so LAN clients can reach it without relying on Tailscale exposure. Remove the blanket tailscale0 trust from the shared firewall so tailnet traffic follows explicit host firewall rules instead of inheriting access to every listening service. Assisted-by: OpenAI:gpt-5 --- common/core.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'common') diff --git a/common/core.nix b/common/core.nix index 5d36646..9e9ca7a 100644 --- a/common/core.nix +++ b/common/core.nix @@ -16,8 +16,8 @@ # Enable networking networking.networkmanager.enable = true; - # for tailscale - networking.firewall.trustedInterfaces = [ "tailscale0" ]; + # for tailscale; open only its discovery/connection UDP port and let the + # normal host firewall rules apply to tailnet traffic too. networking.firewall.allowedUDPPorts = [ 41641 ]; services.tailscale.enable = true; -- cgit v1.3