feat: add macvtap networking to microvms

hosts/common/core/system.nix

@@ -12,10 +12,21 @@
     libWithNet = (import "${inputs.lib-net}/net.nix" {inherit lib;}).lib;
   in
     lib.recursiveUpdate libWithNet {
-      net.cidr = rec {
-        hostCidr = n: x: "${libWithNet.net.cidr.host n x}/${libWithNet.net.cidr.length x}";
-        ip = x: lib.head (lib.splitString "/" x);
-        canonicalize = x: libWithNet.net.cidr.make (libWithNet.net.cidr.length x) (ip x);
+      net = {
+        cidr = rec {
+          hostCidr = n: x: "${libWithNet.net.cidr.host n x}/${libWithNet.net.cidr.length x}";
+          ip = x: lib.head (lib.splitString "/" x);
+          canonicalize = x: libWithNet.net.cidr.make (libWithNet.net.cidr.length x) (ip x);
+        };
+        mac = {
+          # Adds offset to the given base address and ensures the result is in
+          # a locally administered range by replacing the second nibble with a 2.
+          addPrivate = base: offset: let
+            added = libWithNet.net.mac.add base offset;
+            pre = lib.substring 0 1 added;
+            suf = lib.substring 2 (-1) added;
+          in "${pre}2${suf}";
+        };
       };
     };
 

hosts/ward/default.nix

@@ -3,6 +3,7 @@
   inputs,
   lib,
   nixos-hardware,
+  nodeSecrets,
   pkgs,
   ...
 }: {
@@ -25,7 +26,16 @@
 
   boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" "r8169"];
 
-  extra.microvms.test.system = "x86_64-linux";
+  extra.microvms = let
+    macOffset = config.lib.net.mac.addPrivate nodeSecrets.networking.interfaces."wan-nic".mac;
+  in {
+    test = {
+      autostart = true;
+      mac = macOffset "00:00:00:00:00:01";
+      macvtap = "wan";
+      system = "x86_64-linux";
+    };
+  };
 
   #services.authelia.instances.main = {
   #  enable = true;

hosts/ward/net.nix

@@ -13,7 +13,30 @@ in {
 
   boot.initrd.systemd.network = {
     enable = true;
-    networks = {inherit (config.systemd.network.networks) "10-wan";};
+    networks."10-wan" = {
+      DHCP = "yes";
+      #address = [
+      #  "192.168.178.2/24"
+      #  "fd00::1/64"
+      #];
+      #gateway = [
+      #];
+      matchConfig.MACAddress = nodeSecrets.networking.interfaces."wan-nic".mac;
+      networkConfig.IPv6PrivacyExtensions = "kernel";
+      dhcpV4Config.RouteMetric = 20;
+      dhcpV6Config.RouteMetric = 20;
+    };
+  };
+
+  systemd.network.netdevs."10-wan" = {
+    netdevConfig = {
+      Name = "wan";
+      Kind = "macvtap";
+    };
+    extraConfig = ''
+      [MACVTAP]
+      Mode=bridge
+    '';
   };
 
   systemd.network.networks = {
@@ -27,7 +50,14 @@ in {
       dhcpV4Config.RouteMetric = 10;
       dhcpV6Config.RouteMetric = 10;
     };
-    "10-wan" = {
+    "10-wan-nic" = {
+      matchConfig.MACAddress = nodeSecrets.networking.interfaces."wan-nic".mac;
+      extraConfig = ''
+        [Network]
+        MACVTAP=wan
+      '';
+    };
+    "11-wan" = {
       DHCP = "yes";
       #address = [
       #  "192.168.178.2/24"
@@ -35,7 +65,7 @@ in {
       #];
       #gateway = [
       #];
-      matchConfig.MACAddress = nodeSecrets.networking.interfaces.wan.mac;
+      matchConfig.Name = "wan";
       networkConfig.IPv6PrivacyExtensions = "kernel";
       dhcpV4Config.RouteMetric = 20;
       dhcpV6Config.RouteMetric = 20;