dixie: tether on :11435 in front of llama-server

Pin kyle/tether at c89894b. Listen 0.0.0.0:11435, upstream
127.0.0.1:11434. Open 11435 on tailscale0 next to 11433/11434.

flake.lock

@@ -393,6 +393,7 @@
         "nixpkgs-unstable": "nixpkgs-unstable",
         "sgard": "sgard",
         "sift": "sift",
+        "tether": "tether",
         "tracker": "tracker"
       }
     },
@@ -489,6 +490,27 @@
         "type": "github"
       }
     },
+    "tether": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1790149025,
+        "narHash": "sha256-3EUf6ke80hm8o+YyS3wsEfEl5P4a6z6XCNwgYRIhxos=",
+        "ref": "refs/heads/master",
+        "rev": "c89894b8dcac89aaea9ad72529524c1204884bc0",
+        "revCount": 3,
+        "type": "git",
+        "url": "ssh://git@git.wntrmute.dev/kyle/tether"
+      },
+      "original": {
+        "rev": "c89894b8dcac89aaea9ad72529524c1204884bc0",
+        "type": "git",
+        "url": "ssh://git@git.wntrmute.dev/kyle/tether"
+      }
+    },
     "tracker": {
       "inputs": {
         "nixpkgs": [

flake.nix

@@ -26,6 +26,9 @@
     sift.url = "git+ssh://git@git.wntrmute.dev/kyle/sift?rev=2db001e0d763d0dfd5816076eec5d69187396704";
     sift.inputs.nixpkgs.follows = "nixpkgs";
 
+    tether.url = "git+ssh://git@git.wntrmute.dev/kyle/tether?rev=c89894b8dcac89aaea9ad72529524c1204884bc0";
+    tether.inputs.nixpkgs.follows = "nixpkgs";
+
     lector.url = "github:kisom/lector";
     lector.inputs.nixpkgs.follows = "nixpkgs";
 

hw/dixie/default.nix

@@ -125,6 +125,7 @@ in
   imports = [
     ./hardware-configuration.nix
     ./disk-config.nix
+    inputs.tether.nixosModules.tether
   ];
 
   config = {
@@ -188,15 +189,21 @@ in
       port = 11433; preset = visionModelsIni; modelsMax = 1;
     };
 
+    services.tether = {
+      enable = true;
+      listen = "0.0.0.0:11435";
+      upstream = "http://127.0.0.1:11434";
+    };
+
     # Wi-Fi only host. NetworkManager comes from the base config; the AX9L (mt7921u) becomes
     # the primary once plugged in and the internal CNVi radio stays as fallback. Connection
     # profiles are copied from the live-USB session at install time (see the install notes),
     # not stored in this repo.
     networking.networkmanager.wifi.backend = "wpa_supplicant";
 
-    # Reachable only over the tailnet: 11434 (router) and 11433 (vision) on tailscale0, and
-    # SSH from the LAN (base config opens 22) for bring-up.
-    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 11433 11434 ];
+    # Reachable only over the tailnet: 11434 (router), 11433 (vision), 11435 (tether)
+    # on tailscale0, and SSH from the LAN (base config opens 22) for bring-up.
+    networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 11433 11434 11435 ];
 
     environment.systemPackages = with pkgs; [
       llama-cpp