| 1 |
# Opens mDNS on the installer medium only, so a headless install stays findable. |
| 2 |
# |
| 3 |
# WHY THIS EXISTS. The server profile's firewall zone deliberately does not |
| 4 |
# allow mDNS: that profile also runs on machines with a public address, and |
| 5 |
# answering 5353 to the internet is not what buys discovery on a LAN |
| 6 |
# (usr/share/alloy/firewalld/alloy-server.xml says it at length). |
| 7 |
# |
| 8 |
# The live installer medium is the one place that reasoning inverts. The |
| 9 |
# headless flow IS `ssh installer@<hostname>.local` (docs/manual/03-installing.md), |
| 10 |
# the medium is on a LAN and has joined no mesh, and it exists for the length of |
| 11 |
# an install. A server-profile ISO without this unit boots a machine that is |
| 12 |
# waiting to be installed and cannot be found, which is the exact failure the |
| 13 |
# baked hostname exists to prevent. |
| 14 |
# |
| 15 |
# Gated on `alloy.installer`, the same kernel argument as the installer account |
| 16 |
# and the tty1 wizard, and written by the ISO build's GRUB entries only. So it |
| 17 |
# is inert on an installed system, which is the same image. |
| 18 |
# |
| 19 |
# RUNTIME, NOT PERMANENT. `--add-service` without `--permanent` writes nothing |
| 20 |
# to /etc and does not survive a reboot. The live medium does not survive a |
| 21 |
# reboot either, and an installed system must never inherit this. |
| 22 |
# |
| 23 |
# Fails safe in the direction that matters. If the condition does not hold, or |
| 24 |
# firewalld is not up, or this unit fails outright, the medium is merely not |
| 25 |
# discoverable by name and the installer is still reachable by IP address from |
| 26 |
# the router's lease table. Nothing is opened that should have stayed shut. |
| 27 |
# |
| 28 |
# No-op on a client-profile medium, where the default zone already allows mDNS. |
| 29 |
# Stated rather than conditional: a unit that asks for what is already true is |
| 30 |
# cheaper than one that has to work out which profile it is on. |
| 31 |
[Unit] |
| 32 |
Description=Alloy installer mDNS |
| 33 |
Documentation=https://git.sr.ht/~maxmj/alloy |
| 34 |
ConditionKernelCommandLine=alloy.installer |
| 35 |
After=firewalld.service |
| 36 |
Requires=firewalld.service |
| 37 |
|
| 38 |
[Service] |
| 39 |
Type=oneshot |
| 40 |
RemainAfterExit=yes |
| 41 |
ExecStart=/usr/bin/firewall-cmd --add-service=mdns |
| 42 |
|
| 43 |
[Install] |
| 44 |
WantedBy=multi-user.target |
| 45 |
|