Tailscale's stub resolver (100.100.100.100) intermittently times out
or SERVFAILs under bursty concurrent lookups (a known upstream issue,
e.g. tailscale/tailscale#6850, #10768, #8829), which was breaking HACS
updates in the Home Assistant container (network_mode: host, so it
inherits nixserve's own resolv.conf). Point nixserve at the local
Pi-hole instead and disable Tailscale's accept-dns so it can't
override it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Allow TCP 8095 (Music Assistant web UI) and UDP 5353 (mDNS) through the
firewall so the LAN interface can reach it and Chromecast discovery works;
previously only the trusted tailscale0 interface had access.
- Enable pihole-ftl/pihole-web for network-wide DNS ad-blocking on the
LAN/Tailscale side, keeping nixserve's own resolution untouched
- Seed a dedicated Pi-hole group that locks the smart TV (by MAC) to
resolving only *.maybec.at, denying everything else
- Add pingvin-share, frigate, mosquitto, and homeassistant docker services
with matching nginx vhosts and firewall port for Home Assistant
- Disable immich (unused for now), add proxySsl option to proxyVhost
- Bump flake.lock (nixpkgs/home-manager upgrade)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ulveandClaude Sonnet 5