straylight: expose llama-server on the tailnet

Bind 0.0.0.0 and open 11434 on tailscale0 only, so localhost and
other tailnet machines can reach the OpenAI-compatible API. LAN
stays closed. rebuild-nixos deploys committed master, not the
working tree.

hw/straylight/default.nix

@@ -121,9 +121,12 @@ in
         HF_HOME = "/var/lib/llama-server/huggingface";
       };
       serviceConfig = {
+        # Bind all interfaces so localhost and the tailnet can both reach the
+        # OpenAI-compatible API. LAN access is still blocked: 11434 is opened
+        # only on tailscale0, not in the global allowedTCPPorts list.
         ExecStart = ''
           ${llama-cpp}/bin/llama-server \
-            --host 127.0.0.1 \
+            --host 0.0.0.0 \
             --port 11434 \
             --models-preset ${llamaModelsIni} \
             --models-max 2
@@ -212,6 +215,8 @@ in
     # Open ports: DNS (53), mc-proxy (443/8443/9443), agent (9444), master (9555), open-webui (8080).
     networking.firewall.allowedTCPPorts = [ 53 443 8080 8443 9443 9444 9555 ];
     networking.firewall.allowedUDPPorts = [ 53 ];
+    # llama.cpp OpenAI-compatible API: tailnet only (localhost is always allowed).
+    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 11434 ];
 
     # DNS: MCNS for internal zones, public resolvers as fallback.
     networking.nameservers = [