diff --git a/clanModules/deltachat.nix b/clanModules/deltachat.nix
index dee04eb5d..fe519ec3b 100644
--- a/clanModules/deltachat.nix
+++ b/clanModules/deltachat.nix
@@ -137,10 +137,10 @@
         }
       '';
       ensureAccounts = [
-        "user@${config.clanCore.machineName}.local"
+        "user@${domain}"
       ];
       ensureCredentials = {
-        "user@${config.clanCore.machineName}.local".passwordFile = pkgs.writeText "dummy" "foobar";
+        "user@${domain}".passwordFile = pkgs.writeText "dummy" "foobar";
       };
     };
 }
diff --git a/nixosModules/clanCore/meshnamed/default.nix b/nixosModules/clanCore/meshnamed/default.nix
index 804c85de5..6dc4e16b6 100644
--- a/nixosModules/clanCore/meshnamed/default.nix
+++ b/nixosModules/clanCore/meshnamed/default.nix
@@ -1,12 +1,19 @@
 { config, lib, pkgs, ... }:
 let
-  localAddress = "fd66:29e9:f422:8dfe:beba:68ec:bd09:7876";
+  cfg = config.clan.networking.meshnamed;
 in
 {
   options.clan.networking.meshnamed = {
     enable = (lib.mkEnableOption "meshnamed") // {
       default = config.clan.networking.meshnamed.networks != { };
     };
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "fd66:29e9:f422:8dfe:beba:68ec:bd09:7876";
+      description = lib.mdDoc ''
+        The address to listen on.
+      '';
+    };
     networks = lib.mkOption {
       default = { };
       type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
@@ -32,21 +39,24 @@ in
   };
   config = lib.mkIf config.clan.networking.meshnamed.enable {
     # we assign this random source address to bind meshnamed to.
-    systemd.network.networks.loopback-addresses = {
-      matchConfig.Name = "lo";
-      networkConfig.Address = [ localAddress ];
+    systemd.network.netdevs."08-meshnamed" = {
+      netdevConfig = {
+        Name = "meshnamed";
+        Kind = "dummy";
+      };
+    };
+    systemd.network.networks."08-meshnamed" = {
+      matchConfig.Name = "meshnamed";
+      networkConfig = {
+        Address = [ "${cfg.listenAddress}/128" ];
+        DNS = [ config.clan.networking.meshnamed.listenAddress ];
+        Domains = [ "~${lib.concatMapStringsSep "," (network: network.name) (builtins.attrValues config.clan.networking.meshnamed.networks)}" ];
+      };
     };
-
-
-    services.resolved.extraConfig = ''
-      [Resolve]
-      DNS=${localAddress}
-      Domains=~${lib.concatMapStringsSep " " (network: network.name) (builtins.attrValues config.clan.networking.meshnamed.networks)}
-    '';
 
     # for convience, so we can debug with dig
     networking.extraHosts = ''
-      ${localAddress} meshnamed
+      ${cfg.listenAddress} meshnamed
     '';
 
     systemd.services.meshnamed =
@@ -55,11 +65,13 @@ in
           (builtins.attrValues config.clan.networking.meshnamed.networks);
       in
       {
+        # fix container test
+        after = [ "network.target" ] ++ lib.optional config.boot.isContainer "sys-devices-virtual-net-meshnamed.device";
+        bindsTo = lib.optional (!config.boot.isContainer) "sys-devices-virtual-net-meshnamed.device";
         wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
         serviceConfig = {
           Type = "simple";
-          ExecStart = "${pkgs.callPackage ../../../pkgs/meshname/default.nix { }}/bin/meshnamed -networks ${networks} -listenaddr [${localAddress}]:53";
+          ExecStart = "${pkgs.callPackage ../../../pkgs/meshname/default.nix { }}/bin/meshnamed -networks ${networks} -listenaddr [${cfg.listenAddress}]:53";
 
           # to bind port 53
           AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
diff --git a/nixosModules/clanCore/networking.nix b/nixosModules/clanCore/networking.nix
index a8526a405..d2c5dacbc 100644
--- a/nixosModules/clanCore/networking.nix
+++ b/nixosModules/clanCore/networking.nix
@@ -22,11 +22,26 @@
     # conflicts with systemd-resolved
     networking.useHostResolvConf = false;
 
+    # Allow PMTU / DHCP
+    networking.firewall.allowPing = true;
+
     # The notion of "online" is a broken concept
     # https://github.com/systemd/systemd/blob/e1b45a756f71deac8c1aa9a008bd0dab47f64777/NEWS#L13
     systemd.services.NetworkManager-wait-online.enable = false;
     systemd.network.wait-online.enable = false;
 
+    # Provide a default network configuration but don't compete with network-manager or dhcpcd
+    systemd.network.networks."50-uplink" = lib.mkIf (!(config.networking.networkmanager.enable || config.networking.dhcpcd.enable)) {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        DHCP = "yes";
+        LLDP = "yes";
+        LLMNR = "yes";
+        MulticastDNS = "yes";
+        IPv6AcceptRA = "yes";
+      };
+    };
+
     # Use networkd instead of the pile of shell scripts
     networking.useNetworkd = lib.mkDefault true;
     networking.useDHCP = lib.mkDefault false;
diff --git a/nixosModules/clanCore/zerotier/default.nix b/nixosModules/clanCore/zerotier/default.nix
index 9c3d68868..c263a621f 100644
--- a/nixosModules/clanCore/zerotier/default.nix
+++ b/nixosModules/clanCore/zerotier/default.nix
@@ -91,15 +91,16 @@ in
       # having to re-import nixpkgs.
       services.zerotierone.package = lib.mkDefault (pkgs.zerotierone.overrideAttrs (_old: { meta = { }; }));
     })
-    (lib.mkIf (facts ? zerotier-meshname && (facts.zerotier-meshname.value or null) != null) {
+    (lib.mkIf ((facts.zerotier-meshname.value or null) != null) {
       environment.etc."zerotier/hostname".text = "${facts.zerotier-meshname.value}.vpn";
     })
+    (lib.mkIf ((facts.zerotier-ip.value or null) != null) {
+      environment.etc."zerotier/ip".text = facts.zerotier-ip.value;
+    })
     (lib.mkIf (cfg.networkId != null) {
       clan.networking.meshnamed.networks.vpn.subnet = cfg.subnet;
 
-      systemd.network.enable = true;
-      networking.useNetworkd = true;
-      systemd.network.networks.zerotier = {
+      systemd.network.networks."09-zerotier" = {
         matchConfig.Name = "zt*";
         networkConfig = {
           LLMNR = true;
@@ -108,6 +109,18 @@ in
           KeepConfiguration = "static";
         };
       };
+
+      systemd.services.zerotierone.serviceConfig.ExecStartPre = [
+        "+${pkgs.writeShellScript "init-zerotier" ''
+           cp ${config.clanCore.secrets.zerotier.secrets.zerotier-identity-secret.path} /var/lib/zerotier-one/identity.secret
+
+           ${lib.optionalString (cfg.controller.enable) ''
+             mkdir -p /var/lib/zerotier-one/controller.d/network
+             ln -sfT ${pkgs.writeText "net.json" (builtins.toJSON networkConfig)} /var/lib/zerotier-one/controller.d/network/${cfg.networkId}.json
+           ''}
+         ''}"
+      ];
+
       networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ]; # mdns
       networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ]; # mdns
       networking.networkmanager.unmanaged = [ "interface-name:zt*" ];
@@ -156,14 +169,6 @@ in
     (lib.mkIf (cfg.controller.enable && (facts.zerotier-network-id.value or null) != null) {
       clan.networking.zerotier.networkId = facts.zerotier-network-id.value;
       environment.etc."zerotier/network-id".text = facts.zerotier-network-id.value;
-
-      systemd.services.zerotierone.serviceConfig.ExecStartPre = [
-        "+${pkgs.writeShellScript "init-zerotier" ''
-           cp ${config.clanCore.secrets.zerotier.secrets.zerotier-identity-secret.path} /var/lib/zerotier-one/identity.secret
-           mkdir -p /var/lib/zerotier-one/controller.d/network
-           ln -sfT ${pkgs.writeText "net.json" (builtins.toJSON networkConfig)} /var/lib/zerotier-one/controller.d/network/${cfg.networkId}.json
-         ''}"
-      ];
       systemd.services.zerotierone.serviceConfig.ExecStartPost = [
         "+${pkgs.writeShellScript "whitelist-controller" ''
           ${config.clanCore.clanPkgs.zerotier-members}/bin/zerotier-members allow ${builtins.substring 0 10 cfg.networkId}