dotfiles/systems/ceres/config/networking.nix

{
  lib,
  flake,
  ...
}:
let
  inherit (flake.config.machines.devices) ceres;
  inherit (flake.config.services) instances;
  wireguardService = instances.wireGuard;
in
{
  networking = {
    hostName = ceres.name;
    # NetworkManager disabled - using systemd-networkd for bridge management
    # Having both enabled causes multiple DHCP leases and IP conflicts
    networkmanager.enable = false;
    nftables.enable = true;
    useDHCP = lib.mkDefault false; # systemd-networkd handles DHCP via bridge
    firewall = {
      enable = true;
      allowedTCPPorts = [
        22 # SSH
        25 # SMTP
        139 # SMTP
        587 # SMTP
        2525 # SMTP
        9999 # NC
        wireguardService.ports.port0 # WireGuard
      ];
      allowedUDPPorts = [
        wireguardService.ports.port0 # WireGuard
        wireguardService.ports.port1 # WireGuard
      ];
    };
  };

  # Remote rebuild safeguards:
  # These settings prevent network services from restarting during nixos-rebuild,
  # which would otherwise drop SSH connections when done remotely.
  # The bridge configuration changes enp10s0, so we need to prevent systemd-networkd
  # and NetworkManager from restarting to maintain connectivity.

  # Prevent SSH connections from being killed during network reconfiguration
  systemd.services.sshd = {
    stopIfChanged = false;
    reloadIfChanged = true;
  };

  # Prevent systemd-networkd from restarting during switches to avoid dropping SSH
  systemd.services.systemd-networkd = {
    stopIfChanged = false;
    restartTriggers = lib.mkForce [ ];
  };

  services = {
    avahi = {
      enable = true;
      openFirewall = true;
      nssmdns4 = true;
      publish = {
        enable = true;
        userServices = true;
      };
    };
    sshd.enable = true;
    openssh = {
      enable = true;
      settings.PasswordAuthentication = false;
    };
  };
}