From 2498ec066e6f8c3c82cba40e0208802983502313 Mon Sep 17 00:00:00 2001 From: "K. Isom" Date: Wed, 16 Sep 2026 21:05:52 -0700 Subject: [PATCH] straylight: drop Tailscale Serve loop for llama on :443 The unit re-applied --https=443 every 5s and fought Mattermost for that port. llama is served on :10000, managed outside Nix. Co-Authored-By: Claude Opus 5 (1M context) --- hw/straylight/default.nix | 23 ----------------------- 1 file changed, 23 deletions(-) diff --git a/hw/straylight/default.nix b/hw/straylight/default.nix index 1e60844..8330a3b 100644 --- a/hw/straylight/default.nix +++ b/hw/straylight/default.nix @@ -200,29 +200,6 @@ in }; }; - # TLS for the llama.cpp API over the tailnet. Clients using - # https://straylight.scylla-hammerhead.ts.net/v1 hit Tailscale Serve on - # :443, which proxies to llama-server on localhost:11434. Re-apply every - # 5s so `tailscale serve reset` cannot leave the API dark. - systemd.services.tailscale-serve-llama = { - description = "Keep Tailscale HTTPS proxy for llama-server"; - after = [ "tailscaled.service" "llama-server.service" ]; - wants = [ "tailscaled.service" ]; - wantedBy = [ "multi-user.target" ]; - serviceConfig = { - Type = "simple"; - Restart = "always"; - RestartSec = "5s"; - ExecStart = pkgs.writeShellScript "tailscale-serve-llama" '' - set -eu - while true; do - ${pkgs.tailscale}/bin/tailscale serve --bg --https=443 http://127.0.0.1:11434 >/dev/null || true - sleep 5 - done - ''; - }; - }; - # Local ASR: OpenAI-compatible /v1/audio/transcriptions on 11435. # CPU-only so it does not contend with llama-server for GTT. users.users.whisper-server = {