# Opens mDNS on the installer medium only, so a headless install stays findable.
#
# WHY THIS EXISTS. The server profile's firewall zone deliberately does not
# allow mDNS: that profile also runs on machines with a public address, and
# answering 5353 to the internet is not what buys discovery on a LAN
# (usr/share/alloy/firewalld/alloy-server.xml says it at length).
#
# The live installer medium is the one place that reasoning inverts. The
# headless flow IS `ssh installer@<hostname>.local` (docs/manual/03-installing.md),
# the medium is on a LAN and has joined no mesh, and it exists for the length of
# an install. A server-profile ISO without this unit boots a machine that is
# waiting to be installed and cannot be found, which is the exact failure the
# baked hostname exists to prevent.
#
# Gated on `alloy.installer`, the same kernel argument as the installer account
# and the tty1 wizard, and written by the ISO build's GRUB entries only. So it
# is inert on an installed system, which is the same image.
#
# RUNTIME, NOT PERMANENT. `--add-service` without `--permanent` writes nothing
# to /etc and does not survive a reboot. The live medium does not survive a
# reboot either, and an installed system must never inherit this.
#
# Fails safe in the direction that matters. If the condition does not hold, or
# firewalld is not up, or this unit fails outright, the medium is merely not
# discoverable by name and the installer is still reachable by IP address from
# the router's lease table. Nothing is opened that should have stayed shut.
#
# No-op on a client-profile medium, where the default zone already allows mDNS.
# Stated rather than conditional: a unit that asks for what is already true is
# cheaper than one that has to work out which profile it is on.
[Unit]
Description=Alloy installer mDNS
Documentation=https://git.sr.ht/~maxmj/alloy
ConditionKernelCommandLine=alloy.installer
After=firewalld.service
Requires=firewalld.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/bin/firewall-cmd --add-service=mdns

[Install]
WantedBy=multi-user.target