configuration.nix

@@ -35,11 +35,21 @@
   networking.networkmanager.enable = true;
   networking.firewall.enable = true;
   networking.firewall.allowedTCPPorts = [ 80 443 8448 3051 ];
-  networking.firewall.allowedUDPPorts = [ 80 443 8448 3051 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 8448 3051 5353 ];
   networking.firewall.allowedUDPPortRanges = [
     { from = 49152; to = 65535; }
   ];
 
+  # ── Avahi (mDNS) ───────────────────────────────────────────
+  # Advertise as sovransystemsos.local on the LAN without changing the system
+  # hostname (which must remain "nixos" for flake compatibility — see above).
+  services.avahi = {
+    enable = true;
+    hostName = "sovransystemsos";
+    nssmdns4 = true;
+    publish = { enable = true; addresses = true; };
+  };
+
   # ── Locale / Time ──────────────────────────────────────────
   time.timeZone = "America/Los_Angeles";
   i18n.defaultLocale = "en_US.UTF-8";

modules/core/caddy.nix

@@ -145,6 +145,14 @@ $HAVEN {
 EOF
       fi
 
+      # ── Sovran Hub (LAN access via mDNS) ────────────
+      cat >> /run/caddy/Caddyfile <<EOF
+
+http://sovransystemsos.local {
+  reverse_proxy localhost:8937
+}
+EOF
+
       # ── RTL (LAN access) ────────────────────────────
       cat >> /run/caddy/Caddyfile <<EOF