infra: harden xlab and skydick networking

xlab-gateway: route CN destinations via local WAN

xlab-gw: punch v6 CERNET holes in the WireGuard table (fix AAAA-preferred CERNET sites) ...

The freedom-wgnet policy table (1002) had IPv4 throw routes for the Tsinghua/
CERNET ranges (101.6/16, 166.111/16, ...) so LAN clients reach them direct via
the campus uplink (wan99.0), but had NO IPv6 equivalent -> every v6 destination,
including CERNET, was default-routed through the wg tunnel to skyw-gw. Since
mirrors.tuna.tsinghua.edu.cn is AAAA-preferred, LAN clients hit the tunnel path
for v6 and timed out (TCP handshake started, cert/data flight black-holed),
while v4 worked -- looking like a "TLS downgrade" but actually a routing detour.

Add v6 throw routes for the CERNET blocks (2402:f000::/32 Tsinghua/tuna,
2001:da8::/32 CERNET2, 2001:250::/35 CERNET), mirroring the v4 throws and
skyw-gw's cn_net_v6 direct set. Verified live on xlab-gw: LAN v6 client -> tuna
now egresses wan99.0 direct (http 200), was timeout.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

xlab-gateway: performance governor + BBR/fq + larger socket buffers ...

WG-crypto + routing appliance tuning: powerManagement.cpuFreqGovernor=performance
(pin cores -> consistent WG throughput + lower forwarding jitter); load tcp_bbr +
net.ipv4.tcp_congestion_control=bbr + net.core.default_qdisc=fq; rmem/wmem_max 64M
+ tcp_rmem/tcp_wmem 64M autotune ceiling + netdev_max_backlog 16384 for high-RTT
abroad BDP. Helps xlab-originated TCP; forwarded transit keeps endpoints' own CC.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

xlab: persist CAPWAP DF-clear so Cisco APs can join the WLC over the wg tunnel ...

The lab 3802 (b08b.cfa8.4fa8) joins the C9800 (10.0.10.10) via opt43/DNS, but its
DTLS cert is a ~1469B DON'T-FRAGMENT packet that blackholes on the 1420-MTU
wg-to-wgnet tunnel (AP ignores PMTUD + DHCP interface-mtu). Add a systemd service
that clears DF on UDP->10.0.10.10 at bond.lan254 ingress (tc pedit) so the cert
fragments through and the WLC reassembles it. With this live the AP reached
Operation Status: Registered. See memory cisco-wlc-discovery.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

xlab/kea: pin AP wired MTU to 1420 (interface-mtu) so CAPWAP joins over WG ...

The 3802 sends 1441-byte DF DTLS packets to the WLC and ignores PMTUD
frag-needed (mtu 1420), so the join blackholes on the 1420 wg-to-wgnet tunnel
and cycles every 30s. Add DHCP option-26 interface-mtu=1420 to the cisco-ap
class so APs cap their wired MTU and never exceed the path MTU.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

xlab/kea: announce Cisco WLC 10.0.10.10 via DHCP option 43 (cisco-ap class) ...

Mirrors door1's kea-dhcp4 cisco-ap client-class so remote APs on the lab
(10.253.254.0/24) discover the Catalyst 9800-CL WMI: option-60 "Cisco AP*"
clients get vendor-encapsulated-options F1:04:0A:00:0A:0A (opt43 sub-opt 241).
Both scopes already hand out domain dev.skyw.top + DNS 10.0.0.1; the
CISCO-CAPWAP-CONTROLLER.dev.skyw.top A record (10.0.10.10) is the DNS-discovery
backup. Lab->WLC reachability over wg-to-wgnet confirmed (1.24ms).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

xlab-gw: fix MSS clamp — match SYN-ACK too, use rt mtu ...

Old rule `tcp flags & (syn|ack) == syn` only matched plain SYN.
SYN-ACK from the server has SYN+ACK both set, so masking with
syn|ack and comparing == syn FAILED for SYN-ACK. Result: server
responses came back unclamped, full-MTU TCP segments overflowed
the WG path's effective MTU (1420 inner), large pages silently
stalled — YouTube didn't load, Microsoft pages partial-loaded,
Google was slow. Browsers retried indefinitely, looked like
"the network is broken" from a user perspective.

Replaced with `& (syn|rst) == syn` which matches both plain SYN
and SYN-ACK (only excludes RST, which carries no data). Combined
with `set rt mtu` instead of the hard 1280 — lets the kernel
pick the right MSS per egress interface (wg-to-wgnet → 1380 v4 /
1360 v6) instead of pessimistically clamping everything.

User's commented-out line had the right idea (rt mtu) but wrong
flag mask; fixed both at once.

xlab-gateway: route DNS via local mosdns at 10.0.0.1 ...

Adds services.resolved with primary DNS 10.0.0.1 (network-local mosdns)
and Cloudflare as fallback. Removes the hardcoded DNS=166.111.8.28/29
on the wan99.0 link — those Tsinghua resolvers are subject to GFW
poisoning, and per-link DNS overrode the global resolved policy.

When 10.0.0.1 is reachable, this host inherits CN-aware split routing
and the network analytics-blocking policy. When 10.0.0.1 is down,
resolved transparently falls back to Cloudflare so internet keeps
working; queries return to 10.0.0.1 once it responds again.

seems only mtu 1280 works for rdp

修复MSS

harden and fix: nftables input chain, sudo, agenix, ZFS, NAT priority ...

- Add inet input_filter table to xlab-gateway (policy drop on WAN)
- Restrict NOPASSWD sudo to ldx only; ylw uses password sudo via wheel
- Restructure secrets.nix with admins list, prepare for ylw ed25519 key
- Add ye-lw21 to trusted-users in common.nix
- Remove contradictory relatime=on when atime=off on rpool
- Fix NAT postrouting priority: filter → srcnat
- Remove duplicate nixpkgs.hostPlatform from xlab-gateway hardware-configuration

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

clamp mss to pmtu fix v6

Update networking.nix

Update networking.nix

add route from subnet to phicomm mgmt

fix gateway itself to .1

Update default.nix

Update default.nix

agenix?

Update dhcp.nix

Update dhcp.nix

fix syntax error

make sure DHCP start after interface initialization

skydick: switch Samba to ldapsam, rename ylw→ye-lw21, drop legacy datasets ...

- Samba passdb backend changed from tdbsam to ldapsam:ldap://10.0.0.1
- Added samba-ldap-admin-password oneshot to seed LDAP admin cred before smbd
- Pinned storage group to GID 997 to match LDAP posixGroup
- Renamed ylw to ye-lw21 across all hosts (users.nix, skydick, xlab-gateway)
- Removed legacy tmpfiles and NFS exports (share/backup/torrent/vm destroyed)
- Added bootstrap LDIF for sambaDomain, storage group, machines OU

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: equalize ldx and ylw permissions ...

- Add ylw to NOPASSWD sudo rule (matching ldx for deploy-rs)
- Add ldx hashedPassword on xlab-gateway (matching ylw)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: unify ylw as common admin, keep host-specific passwords and groups ...

Move ylw base identity (isNormalUser, wheel, SSH key) to modules/users.nix
alongside ldx. Host configs retain only extra groups and hashedPassword.
Also renames ye-lw21 to ylw on skydick.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: fix ylw user missing isNormalUser and add wheel group ...

Co-Authored-By: Claude Opus 4.6 <[email protected]>

add ylw user to xlab-gateway

xlab-gateway: add ULA route for internal IPv6 reachability ...

Route fd99:23eb:1682::/48 via wg-to-wgnet in main table so
xlab-gateway and LAN clients can reach 10.0.0.1's IPv6
(fd99:23eb:1682::1). Without this, ULA traffic went through
the WAN default route and got dropped.

Co-Authored-By: Claude Opus 4.6 <[email protected]>