config/services/idmail.nix

@@ -2,7 +2,6 @@
   inputs,
   config,
   globals,
-  pkgs,
   ...
 }:
 let
@@ -43,7 +42,7 @@ in
   };
 
   services.idmail = {
-    package = inputs.idmail.packages.${pkgs.system}.default;
+    package = inputs.idmail.packages."aarch64-linux".default;
     enable = true;
     # Stalwart will change permissions due to SQLite implementation.
     # Therefore, run as stalwart-mail since we don't allow reading

config/services/immich.nix

@@ -252,7 +252,7 @@ in
     after = [ "conntrack" ];
     rules = [
       "iifname services ip saddr ${nodes.nucnix-nginx.config.wireguard.services.ipv4} tcp dport 2283 accept"
-      "iifname podman1 oifname lan-services accept"
+      "iifname podman1 oifname lan accept"
     ];
   };
   systemd.tmpfiles.settings = {

flake.nix

@@ -4,7 +4,6 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixp-meta.url = "git+https://forge.lel.lol/patrick/nixp-meta.git";
-    mdns.url = "git+https://forge.lel.lol/patrick/mdns-repeater.git";
     idmail = {
       url = "github:oddlama/idmail/";
       inputs.nixpkgs.follows = "nixpkgs";

hosts/nucnix/forwarding.nix

@@ -82,4 +82,26 @@ mkMerge [
     ];
     protocol = "udp";
   })
+  {
+    networking.nftables.ruleset = ''
+      table ip mdns {
+        chain prerouting {
+            type filter hook prerouting priority mangle; policy accept;
+
+            iifname {lan-home, lan-services} ip daddr 224.0.0.251 meta mark 0xa5f3 jump mdns-saddr
+            iifname {lan-home, lan-services} ip daddr 224.0.0.251 meta mark != 0xa5f3 jump mdns
+        }
+        chain mdns {
+            meta mark set 0xa5f3
+            iifname lan-services dup to 224.0.0.251 device lan-home
+            iifname lan-home dup to 224.0.0.251 device lan-services
+        }
+        chain mdns-saddr {
+            # repeat mDNS from IoT to main
+            iifname lan-services ip saddr set 10.99.20.1
+            iifname lan-home ip saddr set 10.99.10.1
+        }
+      }
+    '';
+  }
 ]

hosts/nucnix/mdns.nix

@@ -1,75 +0,0 @@
-{
-  inputs,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = {
-    interfaces = "lan-.*";
-    rules = [
-      {
-        from = "lan-home";
-        to = "lan-services";
-        allow_questions = "(nucnix|elisabeth)";
-        allow_answers = "";
-      }
-      {
-        from = "lan-services";
-        to = "lan-home";
-        allow_questions = "";
-        allow_answers = "(nucnix|elisabeth)";
-      }
-    ];
-  };
-in
-{
-  systemd.services.mdns-relay = {
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
-
-    #environment.RUST_LOG = "debug";
-
-    serviceConfig = {
-      Restart = "on-failure";
-      ExecStart = "${
-        lib.getExe inputs.mdns.packages.${pkgs.system}.default
-      } -c ${pkgs.writeText "config.json" (builtins.toJSON cfg)}";
-
-      # Hardening
-      DynamicUser = true;
-      CapabilityBoundingSet = "";
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true;
-      PrivateUsers = true;
-      PrivateTmp = true;
-      PrivateDevices = true;
-      PrivateMounts = true;
-      ProtectClock = true;
-      ProtectControlGroups = true;
-      ProtectHome = true;
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = [
-        "AF_INET"
-        "AF_INET6"
-        "AF_NETLINK"
-      ];
-      RestrictNamespaces = true;
-      RestrictRealtime = true;
-      RestrictSUIDSGID = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "@system-service"
-        "~@privileged"
-      ];
-      UMask = "0027";
-    };
-  };
-}

hosts/nucnix/net.nix

@@ -18,7 +18,6 @@ in
   imports = [
     ./kea.nix
     ./forwarding.nix
-    ./mdns.nix
   ];
   boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
   networking.nftables.firewall.zones = mkMerge [