feat: switch to DHCP based networking for microvms using mDNS for resolution

hosts/common/core/impermanence.nix

@@ -61,22 +61,6 @@
           mode = "0700";
         }
       ]
-      ++ lib.optionals (config.services.kea.dhcp4.enable || config.services.kea.dhcp6.enable) [
-        {
-          directory = "/var/lib/kea";
-          user = "kea";
-          group = "kea";
-          mode = "0755";
-        }
-      ]
-      ++ lib.optionals config.services.gitea.enable [
-        {
-          directory = "/var/lib/gitea";
-          user = "gitea";
-          group = "gitea";
-          mode = "0755";
-        }
-      ]
       ++ lib.optionals config.security.acme.acceptTerms [
         {
           directory = "/var/lib/acme";
@@ -101,13 +85,29 @@
           mode = "0750";
         }
       ]
-      ++ lib.optionals config.services.opendkim.enable [
+      ++ lib.optionals config.services.postgresql.enable [
         {
           directory = "/var/lib/postgresql";
           user = "postgres";
           group = "postgres";
           mode = "0755";
         }
+      ]
+      ++ lib.optionals config.services.gitea.enable [
+        {
+          directory = "/var/lib/gitea";
+          user = "gitea";
+          group = "gitea";
+          mode = "0755";
+        }
+      ]
+      ++ lib.optionals config.services.kanidm.enableServer [
+        {
+          directory = "/var/lib/kanidm";
+          user = "kanidm";
+          group = "kanidm";
+          mode = "0755";
+        }
       ];
   };
 }

hosts/common/core/resolved.nix

@@ -13,7 +13,7 @@
       "8.8.8.8"
       "2001:4860:4860::8844"
     ];
-    llmnr = "true"; # Microsoft's version of mDNS
+    llmnr = "false";
     extraConfig = ''
       Domains=~.
       MulticastDNS=true

hosts/nom/net.nix

@@ -13,14 +13,20 @@
     "10-lan1" = {
       DHCP = "yes";
       matchConfig.MACAddress = config.repo.secrets.local.networking.interfaces.lan1.mac;
-      networkConfig.IPv6PrivacyExtensions = "yes";
+      networkConfig = {
+        IPv6PrivacyExtensions = "yes";
+        MulticastDNS = true;
+      };
       dhcpV4Config.RouteMetric = 10;
       dhcpV6Config.RouteMetric = 10;
     };
     "10-wlan1" = {
       DHCP = "yes";
       matchConfig.MACAddress = config.repo.secrets.local.networking.interfaces.wlan1.mac;
-      networkConfig.IPv6PrivacyExtensions = "yes";
+      networkConfig = {
+        IPv6PrivacyExtensions = "yes";
+        MulticastDNS = true;
+      };
       dhcpV4Config.RouteMetric = 40;
       dhcpV6Config.RouteMetric = 40;
     };

hosts/ward/default.nix

@@ -83,18 +83,6 @@ in {
   }: {
     rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2TxWynLb8V9SP45kFqsoCWhe/dG8N1xWNuJG5VQndq";
 
-    rekey.secrets."kanidm-self-signed.crt" = {
-      file = ./secrets/kanidm-self-signed.crt.age;
-      mode = "440";
-      owner = "nginx";
-      group = "kanidm";
-    };
-    rekey.secrets."kanidm-self-signed.key" = {
-      file = ./secrets/kanidm-self-signed.key.age;
-      mode = "440";
-      owner = "nginx";
-      group = "kanidm";
-    };
     rekey.secrets."dhparams.pem" = {
       # TODO make own?
       file = ../zackbiene/secrets/dhparams.pem.age;
@@ -102,10 +90,6 @@ in {
       group = "nginx";
     };
 
-    networking.hosts = {
-      "192.168.100.12" = [auth.domain];
-    };
-
     rekey.secrets.acme-credentials = {
       file = ./secrets/acme-credentials.age;
       mode = "440";
@@ -125,10 +109,6 @@ in {
     };
     users.groups.acme.members = ["nginx"];
 
-    # TODO needed in my current testing network that has no ipv6 connectivity
-    # TODO but these should use fallback......... something's wrong
-    systemd.network.networks."10-wan".networkConfig.DNS = ["1.1.1.1" "8.8.8.8"];
-
     # TODO reload nginx when acme is renewed
 
     # TODO make default nginx config in core to reduce boilerplate?
@@ -195,18 +175,16 @@ in {
       local-vms-to-local.allowedTCPPorts = [8300];
     };
 
-    # systemd.services.kanidm = let
-    #   cfg = config.services.kanidm;
-    #   certName = config.services.nginx.virtualHosts.${cfg.serverSettings.domain}.useACMEHost;
-    # in {
-    #   requires = [ "acme-finished-${certName}.target" ];
-    #   serviceConfig.LoadCredential = let
-    #     certDir = config.security.acme.certs.${certName}.directory;
-    #   in [
-    #     "fullchain.pem:${certDir}/fullchain.pem"
-    #     "key.pem:${certDir}/key.pem"
-    #   ];
-    # };
+    rekey.secrets."kanidm-self-signed.crt" = {
+      file = ./secrets/kanidm-self-signed.crt.age;
+      mode = "440";
+      group = "kanidm";
+    };
+    rekey.secrets."kanidm-self-signed.key" = {
+      file = ./secrets/kanidm-self-signed.key.age;
+      mode = "440";
+      group = "kanidm";
+    };
 
     services.kanidm = {
       enableServer = true;
@@ -221,7 +199,11 @@ in {
         bindaddress = "${config.extra.wireguard."${parentNodeName}-local-vms".ipv4}:8300";
         trust_x_forward_for = true;
       };
+    };
 
+    environment.systemPackages = [pkgs.kanidm];
+
+    services.kanidm = {
       enableClient = true;
       clientSettings = {
         uri = config.services.kanidm.serverSettings.origin;
@@ -229,7 +211,5 @@ in {
         verify_hostnames = true;
       };
     };
-
-    environment.systemPackages = [pkgs.kanidm];
   };
 }

hosts/ward/net.nix

@@ -6,7 +6,7 @@
   inherit (config.lib.net) cidr;
 
   lanCidrv4 = "192.168.100.0/24";
-  lanCidrv6 = "fd00::/64";
+  lanCidrv6 = "fd10::/64";
 in {
   networking.hostId = config.repo.secrets.local.networking.hostId;
 
@@ -63,6 +63,7 @@ in {
         IPForward = "yes";
         IPv6PrivacyExtensions = "yes";
         IPv6SendRA = true;
+        MulticastDNS = true;
       };
       # Announce a static prefix
       ipv6Prefixes = [
@@ -83,13 +84,6 @@ in {
       };
       linkConfig.RequiredForOnline = "routable";
     };
-    # Remaining macvtap interfaces should not be touched.
-    "90-macvtap-no-ll" = {
-      matchConfig.Kind = "macvtap";
-      networkConfig.LinkLocalAddressing = "no";
-      linkConfig.ActivationPolicy = "manual";
-      linkConfig.Unmanaged = "yes";
-    };
   };
 
   # TODO mkForce nftables
@@ -165,7 +159,7 @@ in {
             interface = "lan-self";
             subnet = lanCidrv4;
             pools = [
-              {pool = "${cidr.host 40 lanCidrv4} - ${cidr.host (-6) lanCidrv4}";}
+              {pool = "${cidr.host 20 lanCidrv4} - ${cidr.host (-6) lanCidrv4}";}
             ];
             option-data = [
               {
@@ -184,10 +178,6 @@ in {
   extra.microvms.networking = {
     baseMac = config.repo.secrets.local.networking.interfaces.lan.mac;
     macvtapInterface = "lan";
-    static = {
-      baseCidrv4 = lanCidrv4;
-      baseCidrv6 = lanCidrv6;
-    };
     wireguard.openFirewallRules = ["lan-to-local"];
   };
 }

hosts/zackbiene/net.nix

@@ -19,7 +19,10 @@ in {
     "10-lan1" = {
       DHCP = "yes";
       matchConfig.MACAddress = config.repo.secrets.local.networking.interfaces.lan1.mac;
-      networkConfig.IPv6PrivacyExtensions = "yes";
+      networkConfig = {
+        IPv6PrivacyExtensions = "yes";
+        MulticastDNS = true;
+      };
       linkConfig.RequiredForOnline = "routable";
     };
     "10-wlan1" = {