checks.nas-topology fails on main: the coordinator's LAN leg has 8731 open, which the check asserts it does not #457

checks.x86_64-linux.nas-topology fails an assertion on origin/main. MEASURED
2026-09-23. Not introduced by any branch; see the comparison below.

The failing assertion

flake.nix:1824, in the "Coordinator LAN doors" block:

error: assertion '(! ((builtins).elem 8731 (coordinator).networking.firewall.interfaces.wlp192s0.allowedTCPPorts))' failed
at /home/tom/overnight-tuesday/wt/dotfiles/flake.nix:1824:11:
  1823|           assert !(builtins.elem 9292 coordinator.networking.firewall.interfaces.wlp192s0.allowedTCPPorts);
  1824|           assert !(builtins.elem 8731 coordinator.networking.firewall.interfaces.wlp192s0.allowedTCPPorts);
     |           ^
  1825|           assert !(builtins.elem 3003 coordinator.networking.firewall.interfaces.wlp192s0.allowedTCPPorts);

The comment above it states the invariant plainly: "The coordinator serves no
model: no inference door on its LAN leg."

It is pre-existing, not any branch's doing

The same attribute, evaluated on the branch under test and on pristine
origin/main at f8e27b432fd1d41887c79f2f39ea83b9de93e5e6:

$ nix eval --json .#nixosConfigurations.coordinator.config.networking.firewall.interfaces.wlp192s0.allowedTCPPorts
[80,443,8731]

$ nix eval --json "git+file://<clone>?rev=f8e27b432fd1d41887c79f2f39ea83b9de93e5e6#nixosConfigurations.coordinator.config.networking.firewall.interfaces.wlp192s0.allowedTCPPorts"
[80,443,8731]

Identical. rc 0 both times.

Where the 8731 comes from

modules/strix.nix:72 enables Halogen on both twins and points the coordinator's
lanInterface at its wifi leg:

services.halogen = {
  enable = true;
  autoStart = config.networking.hostName == "worker";
  lanInterface = if config.networking.hostName == "coordinator" then "wlp192s0" else "enp191s0";

modules/halogen.nix:518 then opens the port on that interface unconditionally:

networking.firewall.interfaces.${cfg.lanInterface}.allowedTCPPorts = [ cfg.port ];

cfg.port defaults to 8731. So the coordinator has an open 8731 on its LAN leg
whenever services.halogen.enable is true, and that is true on the coordinator
even though autoStart is false there. autoStart = false does not close the
door; it only means nothing is listening behind it at boot. An operator running
halogen-switch flash puts a model behind an already-open LAN port.

What is actually in contradiction

Two declarations, both deliberate, that cannot both be right:

1. nas-topology says the coordinator has no inference door on wlp192s0.
2. modules/strix.nix gives the coordinator a Halogen lanInterface of
   wlp192s0, and modules/halogen.nix opens the port on it.

Whichever one is the intent, the other needs to change in the same commit. Two
candidate resolutions, neither of them measured against what Tom wants:

• if the coordinator genuinely should not serve on the LAN, gate the firewall
  line in modules/halogen.nix on autoStart, or add an openFirewall option
  and set it false on the coordinator;
• if the coordinator should serve on the LAN on demand, the nas-topology
  assertion and its comment are stale and should be narrowed to the ports that
  really must stay shut.

I have not picked one. This is a firewall decision on a live desktop and it is
Tom's.

Provenance

Found by the 2026-09-22/23 overnight run, item 17 (ax-conwip-dotfiles-module),
while proving that item's own check. That item's change is a home-manager module
gated off plus one checks entry, and it touches no firewall option. Filed under
the standing instruction to file issues in dotfiles so fixes become durable.

Related: #455, the other thing standing between this repository and a green
nix flake check.