feat: mdns-relay

config/services/idmail.nix

@@ -2,6 +2,7 @@
   inputs,
   config,
   globals,
+  pkgs,
   ...
 }:
 let
@@ -42,7 +43,7 @@ in
   };
 
   services.idmail = {
-    package = inputs.idmail.packages."aarch64-linux".default;
+    package = inputs.idmail.packages.${pkgs.system}.default;
     enable = true;
     # Stalwart will change permissions due to SQLite implementation.
     # Therefore, run as stalwart-mail since we don't allow reading

flake.nix

@@ -4,6 +4,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixp-meta.url = "git+https://forge.lel.lol/patrick/nixp-meta.git";
+    mdns.url = "git+https://forge.lel.lol/patrick/mdns-repeater.git";
     idmail = {
       url = "github:oddlama/idmail/";
       inputs.nixpkgs.follows = "nixpkgs";

hosts/nucnix/mdns.nix

@@ -0,0 +1,75 @@
+{
+  inputs,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = {
+    interfaces = "lan-.*";
+    rules = [
+      {
+        from = "lan-home";
+        to = "lan-services";
+        allow_questions = "(nucnix|elisabeth)";
+        allow_answers = "";
+      }
+      {
+        from = "lan-services";
+        to = "lan-home";
+        allow_questions = "";
+        allow_answers = "(nucnix|elisabeth)";
+      }
+    ];
+  };
+in
+{
+  systemd.services.mdns-relay = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+
+    #environment.RUST_LOG = "debug";
+
+    serviceConfig = {
+      Restart = "on-failure";
+      ExecStart = "${
+        lib.getExe inputs.mdns.packages.${pkgs.system}.default
+      } -c ${pkgs.writeText "config.json" (builtins.toJSON cfg)}";
+
+      # Hardening
+      DynamicUser = true;
+      CapabilityBoundingSet = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateUsers = true;
+      PrivateTmp = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_NETLINK"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallArchitectures = "native";
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged"
+      ];
+      UMask = "0027";
+    };
+  };
+}

hosts/nucnix/net.nix

@@ -18,6 +18,7 @@ in
   imports = [
     ./kea.nix
     ./forwarding.nix
+    ./mdns.nix
   ];
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
   networking.nftables.firewall.zones = mkMerge [