From fcb22f254c40d11e43b250577af6063c08191047 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Wed, 15 Nov 2023 07:44:30 +0100
Subject: [PATCH] move resolved configuration to a dummy interface

---
 nixosModules/clanCore/meshnamed/default.nix | 39 +++++++++++++--------
 nixosModules/clanCore/networking.nix        | 12 +++++++
 nixosModules/clanCore/zerotier/default.nix  |  9 ++---
 3 files changed, 40 insertions(+), 20 deletions(-)

diff --git a/nixosModules/clanCore/meshnamed/default.nix b/nixosModules/clanCore/meshnamed/default.nix
index 804c85de5..774dd77d8 100644
--- a/nixosModules/clanCore/meshnamed/default.nix
+++ b/nixosModules/clanCore/meshnamed/default.nix
@@ -1,12 +1,19 @@
 { config, lib, pkgs, ... }:
 let
-  localAddress = "fd66:29e9:f422:8dfe:beba:68ec:bd09:7876";
+  cfg = config.clan.networking.meshnamed;
 in
 {
   options.clan.networking.meshnamed = {
     enable = (lib.mkEnableOption "meshnamed") // {
       default = config.clan.networking.meshnamed.networks != { };
     };
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "fd66:29e9:f422:8dfe:beba:68ec:bd09:7876";
+      description = lib.mdDoc ''
+        The address to listen on.
+      '';
+    };
     networks = lib.mkOption {
       default = { };
       type = lib.types.attrsOf (lib.types.submodule ({ name, ... }: {
@@ -32,21 +39,24 @@ in
   };
   config = lib.mkIf config.clan.networking.meshnamed.enable {
     # we assign this random source address to bind meshnamed to.
-    systemd.network.networks.loopback-addresses = {
-      matchConfig.Name = "lo";
-      networkConfig.Address = [ localAddress ];
+    systemd.network.netdevs."08-meshnamed" = {
+      netdevConfig = {
+        Name = "meshnamed";
+        Kind = "dummy";
+      };
+    };
+    systemd.network.networks."08-meshnamed" = {
+      matchConfig.Name = "meshnamed";
+      networkConfig = {
+        Address = [ "${cfg.listenAddress}/128" ];
+        DNS = [ config.clan.networking.meshnamed.listenAddress ];
+        Domains = [ "~${lib.concatMapStringsSep "," (network: network.name) (builtins.attrValues config.clan.networking.meshnamed.networks)}" ];
+      };
     };
-
-
-    services.resolved.extraConfig = ''
-      [Resolve]
-      DNS=${localAddress}
-      Domains=~${lib.concatMapStringsSep " " (network: network.name) (builtins.attrValues config.clan.networking.meshnamed.networks)}
-    '';
 
     # for convience, so we can debug with dig
     networking.extraHosts = ''
-      ${localAddress} meshnamed
+      ${cfg.listenAddress} meshnamed
     '';
 
     systemd.services.meshnamed =
@@ -55,11 +65,12 @@ in
           (builtins.attrValues config.clan.networking.meshnamed.networks);
       in
       {
+        after = [ "network.target" "sys-devices-virtual-net-meshnamed.device" ];
+        bindsTo = [ "sys-devices-virtual-net-meshnamed.device" ];
         wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
         serviceConfig = {
           Type = "simple";
-          ExecStart = "${pkgs.callPackage ../../../pkgs/meshname/default.nix { }}/bin/meshnamed -networks ${networks} -listenaddr [${localAddress}]:53";
+          ExecStart = "${pkgs.callPackage ../../../pkgs/meshname/default.nix { }}/bin/meshnamed -networks ${networks} -listenaddr [${cfg.listenAddress}]:53";
 
           # to bind port 53
           AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
diff --git a/nixosModules/clanCore/networking.nix b/nixosModules/clanCore/networking.nix
index a8526a405..4df14d270 100644
--- a/nixosModules/clanCore/networking.nix
+++ b/nixosModules/clanCore/networking.nix
@@ -27,6 +27,18 @@
     systemd.services.NetworkManager-wait-online.enable = false;
     systemd.network.wait-online.enable = false;
 
+    # Provide a default network configuration but don't compete with network-manager or dhcpcd
+    systemd.network.networks."50-uplink" = lib.mkIf (!(config.networking.networkmanager.enable || config.networking.dhcpcd.enable)) {
+      matchConfig.Type = "ether";
+      networkConfig = {
+        DHCP = "yes";
+        LLDP = "yes";
+        LLMNR = "yes";
+        MulticastDNS = "yes";
+        IPv6AcceptRA = "yes";
+      };
+    };
+
     # Use networkd instead of the pile of shell scripts
     networking.useNetworkd = lib.mkDefault true;
     networking.useDHCP = lib.mkDefault false;
diff --git a/nixosModules/clanCore/zerotier/default.nix b/nixosModules/clanCore/zerotier/default.nix
index 9c3d68868..ad9b11605 100644
--- a/nixosModules/clanCore/zerotier/default.nix
+++ b/nixosModules/clanCore/zerotier/default.nix
@@ -97,17 +97,14 @@ in
     (lib.mkIf (cfg.networkId != null) {
       clan.networking.meshnamed.networks.vpn.subnet = cfg.subnet;
 
-      systemd.network.enable = true;
-      networking.useNetworkd = true;
-      systemd.network.networks.zerotier = {
+      systemd.network.networks."09-zerotier" = {
         matchConfig.Name = "zt*";
         networkConfig = {
-          LLMNR = true;
-          LLDP = true;
           MulticastDNS = true;
-          KeepConfiguration = "static";
+          Address = [ "${facts.zerotier-ip.value}/88" ];
         };
       };
+
       networking.firewall.interfaces."zt+".allowedTCPPorts = [ 5353 ]; # mdns
       networking.firewall.interfaces."zt+".allowedUDPPorts = [ 5353 ]; # mdns
       networking.networkmanager.unmanaged = [ "interface-name:zt*" ];