From ab57d8eae597938e63f06ff9b356548bcd8ce0bd Mon Sep 17 00:00:00 2001
From: yokai <accounts.8ef6c@simplelogin.com>
Date: Tue, 4 Aug 2026 16:45:39 -0500
Subject: kusanagi/mdns: publish workstation on wifi LAN

Advertise kusanagi.local via Avahi on the Wi-Fi interface so LAN clients can use a stable local name instead of the current IP address.

Keep Avahi's firewall hole scoped to wlp8s0 by disabling the module's global openFirewall helper and opening UDP 5353 on that interface explicitly.

Assisted-by: OpenAI:gpt-5
---
 machines/kusanagi/desktop.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

(limited to 'machines')

diff --git a/machines/kusanagi/desktop.nix b/machines/kusanagi/desktop.nix
index c865844..8e1eb8c 100644
--- a/machines/kusanagi/desktop.nix
+++ b/machines/kusanagi/desktop.nix
@@ -22,11 +22,19 @@
     drivers = with pkgs; [ gutenprint ];
   };
 
-  # mDNS: printer discovery, and resolves kusanagi's *.local NAS names.
+  # mDNS: publish kusanagi.local and resolve *.local LAN names.
+  # Keep the firewall opening scoped to the Wi-Fi LAN interface.
+  networking.firewall.interfaces.wlp8s0.allowedUDPPorts = [ 5353 ];
   services.avahi = {
     enable = true;
     nssmdns4 = true;
-    openFirewall = true;
+    openFirewall = false;
+    allowInterfaces = [ "wlp8s0" ];
+    publish = {
+      enable = true;
+      addresses = true;
+      workstation = true;
+    };
   };
 
   # prevent auto-mounting optical disks
-- 
cgit v1.3