From 095dc5dee8f1eae43ecaa34f78401782221bdef9 Mon Sep 17 00:00:00 2001
From: Ryan Yin <xiaoyin_c@qq.com>
Date: Sun, 26 Jul 2026 22:20:10 +0800
Subject: [PATCH] feat(desktop): enable the firewall on desktop machines

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
---
 hosts/12kingdoms-shoukei/default.nix                  |  4 +---
 hosts/idols-aquamarine/monitoring/alert.nix           |  3 +--
 hosts/idols-aquamarine/monitoring/victoriametrics.nix |  7 ++-----
 modules/nixos/desktop/networking/firewall.nix         | 10 ++++++++++
 4 files changed, 14 insertions(+), 10 deletions(-)
 create mode 100644 modules/nixos/desktop/networking/firewall.nix

diff --git a/hosts/12kingdoms-shoukei/default.nix b/hosts/12kingdoms-shoukei/default.nix
index f766e169..adc1ada1 100644
--- a/hosts/12kingdoms-shoukei/default.nix
+++ b/hosts/12kingdoms-shoukei/default.nix
@@ -21,9 +21,7 @@ in
   services.sunshine.enable = lib.mkForce false;
   services.tuned.ppdSettings.main.default = lib.mkForce "power-saver";
 
-  # This laptop joins untrusted networks and the firewall is disabled
-  # (modules/nixos/base/ssh.nix), so a 0.0.0.0:9100 node-exporter would be exposed
-  # to whatever network it is on. It is no longer scraped anyway - disable it.
+  # Laptop joins untrusted networks and is no longer scraped; don't expose :9100.
   services.prometheus.exporters.node.enable = lib.mkForce false;
 
   networking = {
diff --git a/hosts/idols-aquamarine/monitoring/alert.nix b/hosts/idols-aquamarine/monitoring/alert.nix
index 070b9c0a..00c6de36 100644
--- a/hosts/idols-aquamarine/monitoring/alert.nix
+++ b/hosts/idols-aquamarine/monitoring/alert.nix
@@ -52,8 +52,7 @@
         receiver = "telegram";
         routes = [
           {
-            # Meta alerts like Watchdog & InfoInhibitor should never notify,
-            # and info-level alerts are too noisy; route them to a null receiver.
+            # Meta alerts (Watchdog, InfoInhibitor) and info-level noise never notify.
             receiver = "null";
             matchers = [ ''severity =~ "none|info"'' ];
           }
diff --git a/hosts/idols-aquamarine/monitoring/victoriametrics.nix b/hosts/idols-aquamarine/monitoring/victoriametrics.nix
index 80f83bc6..667c48e2 100644
--- a/hosts/idols-aquamarine/monitoring/victoriametrics.nix
+++ b/hosts/idols-aquamarine/monitoring/victoriametrics.nix
@@ -4,11 +4,8 @@
   ...
 }:
 let
-  # Hosts that should not be scraped:
-  # - powered-off machines (SBCs and the whole k3s-prod-1 cluster), to avoid TargetDown
-  #   noise; remove entries from this list when the machines come back online.
-  # - shoukei (a laptop on untrusted networks), its node-exporter is disabled on the
-  #   machine itself, so there is nothing to scrape.
+  # Powered-off hosts (SBCs, k3s-prod-1) plus shoukei (exporter disabled on the
+  # machine); remove entries when they come back online.
   offlineHosts = [
     "shoukei"
     "suzu"
diff --git a/modules/nixos/desktop/networking/firewall.nix b/modules/nixos/desktop/networking/firewall.nix
new file mode 100644
index 00000000..601726f4
--- /dev/null
+++ b/modules/nixos/desktop/networking/firewall.nix
@@ -0,0 +1,10 @@
+# Desktops hold personal data and laptops join untrusted networks, so enable the
+# firewall here (repo-wide default is off, see modules/nixos/base/ssh.nix).
+# SSH/Tailscale/LocalSend/Sunshine keep working via their own `openFirewall` options.
+{
+  networking.firewall = {
+    enable = true;
+    # Trust everything from the tailnet.
+    trustedInterfaces = [ "tailscale0" ];
+  };
+}