kyle/imladris
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

straylight: expose llama-server on the tailnet

Browse Source 
Bind 0.0.0.0 and open 11434 on tailscale0 only, so localhost and
other tailnet machines can reach the OpenAI-compatible API. LAN
stays closed. rebuild-nixos deploys committed master, not the
working tree.
This commit is contained in:
kyle
2026-09-15 23:57:23 -07:00
parent 90d8ce03ae
commit 7b3af4cb13
3 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+3 -2
View File
@@ -8,8 +8,9 @@ A flake-based NixOS configuration managing 8 hosts (all x86_64-linux). Pinned to
## Common Commands ## Common Commands
- **Build/deploy locally**: `rebuild-nixos` (installed to `~/.local/bin` via `make`) - **Build/deploy locally**: commit the working tree, then `rebuild-nixos` (installed to `~/.local/bin` via `make`)
- This runs on the target machine: pulls from local git remote, then `doas nixos-rebuild switch --flake .` - `rebuild-nixos` pulls committed `master` from the local git remote into `/etc/nixos`, then `doas nixos-rebuild switch --flake .`
- Uncommitted changes are not deployed. Do not `nixos-rebuild switch` against the working tree.
- **Build a specific host** (dry run): `nixos-rebuild build --flake .#<hostname>` - **Build a specific host** (dry run): `nixos-rebuild build --flake .#<hostname>`
- **Flash a remote machine**: `./script/flash.sh <config-name> <ssh-address>` (uses nixos-anywhere) - **Flash a remote machine**: `./script/flash.sh <config-name> <ssh-address>` (uses nixos-anywhere)
- **Check if reboot needed**: `./script/check-restart.sh` - **Check if reboot needed**: `./script/check-restart.sh`
CLAUDE.md
+3 -2
View File
@@ -8,8 +8,9 @@ A flake-based NixOS configuration managing 8 hosts (all x86_64-linux). Pinned to
## Common Commands ## Common Commands
- **Build/deploy locally**: `rebuild-nixos` (installed to `~/.local/bin` via `make`) - **Build/deploy locally**: commit the working tree, then `rebuild-nixos` (installed to `~/.local/bin` via `make`)
- This runs on the target machine: pulls from local git remote, then `doas nixos-rebuild switch --flake .` - `rebuild-nixos` pulls committed `master` from the local git remote into `/etc/nixos`, then `doas nixos-rebuild switch --flake .`
- Uncommitted changes are not deployed. Do not `nixos-rebuild switch` against the working tree.
- **Build a specific host** (dry run): `nixos-rebuild build --flake .#<hostname>` - **Build a specific host** (dry run): `nixos-rebuild build --flake .#<hostname>`
- **Flash a remote machine**: `./script/flash.sh <config-name> <ssh-address>` (uses nixos-anywhere) - **Flash a remote machine**: `./script/flash.sh <config-name> <ssh-address>` (uses nixos-anywhere)
- **Check if reboot needed**: `./script/check-restart.sh` - **Check if reboot needed**: `./script/check-restart.sh`
hw/straylight/default.nix
+6 -1
View File
@@ -121,9 +121,12 @@ in
HF_HOME = "/var/lib/llama-server/huggingface"; HF_HOME = "/var/lib/llama-server/huggingface";
}; };
serviceConfig = { serviceConfig = {
# Bind all interfaces so localhost and the tailnet can both reach the
# OpenAI-compatible API. LAN access is still blocked: 11434 is opened
# only on tailscale0, not in the global allowedTCPPorts list.
ExecStart = '' ExecStart = ''
${llama-cpp}/bin/llama-server \ ${llama-cpp}/bin/llama-server \
--host 127.0.0.1 \ --host 0.0.0.0 \
--port 11434 \ --port 11434 \
--models-preset ${llamaModelsIni} \ --models-preset ${llamaModelsIni} \
--models-max 2 --models-max 2
@@ -212,6 +215,8 @@ in
# Open ports: DNS (53), mc-proxy (443/8443/9443), agent (9444), master (9555), open-webui (8080). # Open ports: DNS (53), mc-proxy (443/8443/9443), agent (9444), master (9555), open-webui (8080).
networking.firewall.allowedTCPPorts = [ 53 443 8080 8443 9443 9444 9555 ]; networking.firewall.allowedTCPPorts = [ 53 443 8080 8443 9443 9444 9555 ];
networking.firewall.allowedUDPPorts = [ 53 ]; networking.firewall.allowedUDPPorts = [ 53 ];
# llama.cpp OpenAI-compatible API: tailnet only (localhost is always allowed).
networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 11434 ];
# DNS: MCNS for internal zones, public resolvers as fallback. # DNS: MCNS for internal zones, public resolvers as fallback.
networking.nameservers = [ networking.nameservers = [