Allow TCP 8095 (Music Assistant web UI) and UDP 5353 (mDNS) through the
firewall so the LAN interface can reach it and Chromecast discovery works;
previously only the trusted tailscale0 interface had access.
- Enable pihole-ftl/pihole-web for network-wide DNS ad-blocking on the
LAN/Tailscale side, keeping nixserve's own resolution untouched
- Seed a dedicated Pi-hole group that locks the smart TV (by MAC) to
resolving only *.maybec.at, denying everything else
- Add pingvin-share, frigate, mosquitto, and homeassistant docker services
with matching nginx vhosts and firewall port for Home Assistant
- Disable immich (unused for now), add proxySsl option to proxyVhost
- Bump flake.lock (nixpkgs/home-manager upgrade)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ulveandClaude Sonnet 5