xlab-gw: fix MSS clamp — match SYN-ACK too, use rt mtu ...

Old rule `tcp flags & (syn|ack) == syn` only matched plain SYN.
SYN-ACK from the server has SYN+ACK both set, so masking with
syn|ack and comparing == syn FAILED for SYN-ACK. Result: server
responses came back unclamped, full-MTU TCP segments overflowed
the WG path's effective MTU (1420 inner), large pages silently
stalled — YouTube didn't load, Microsoft pages partial-loaded,
Google was slow. Browsers retried indefinitely, looked like
"the network is broken" from a user perspective.

Replaced with `& (syn|rst) == syn` which matches both plain SYN
and SYN-ACK (only excludes RST, which carries no data). Combined
with `set rt mtu` instead of the hard 1280 — lets the kernel
pick the right MSS per egress interface (wg-to-wgnet → 1380 v4 /
1360 v6) instead of pessimistically clamping everything.

User's commented-out line had the right idea (rt mtu) but wrong
flag mask; fixed both at once.

xlab-gateway: route DNS via local mosdns at 10.0.0.1 ...

Adds services.resolved with primary DNS 10.0.0.1 (network-local mosdns)
and Cloudflare as fallback. Removes the hardcoded DNS=166.111.8.28/29
on the wan99.0 link — those Tsinghua resolvers are subject to GFW
poisoning, and per-link DNS overrode the global resolved policy.

When 10.0.0.1 is reachable, this host inherits CN-aware split routing
and the network analytics-blocking policy. When 10.0.0.1 is down,
resolved transparently falls back to Cloudflare so internet keeps
working; queries return to 10.0.0.1 once it responds again.

seems only mtu 1280 works for rdp

修复MSS

harden and fix: nftables input chain, sudo, agenix, ZFS, NAT priority ...

- Add inet input_filter table to xlab-gateway (policy drop on WAN)
- Restrict NOPASSWD sudo to ldx only; ylw uses password sudo via wheel
- Restructure secrets.nix with admins list, prepare for ylw ed25519 key
- Add ye-lw21 to trusted-users in common.nix
- Remove contradictory relatime=on when atime=off on rpool
- Fix NAT postrouting priority: filter → srcnat
- Remove duplicate nixpkgs.hostPlatform from xlab-gateway hardware-configuration

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

clamp mss to pmtu fix v6

Update networking.nix

Update networking.nix

add route from subnet to phicomm mgmt

fix gateway itself to .1

Update default.nix

Update default.nix

agenix?

Update dhcp.nix

Update dhcp.nix

fix syntax error

make sure DHCP start after interface initialization

skydick: switch Samba to ldapsam, rename ylw→ye-lw21, drop legacy datasets ...

- Samba passdb backend changed from tdbsam to ldapsam:ldap://10.0.0.1
- Added samba-ldap-admin-password oneshot to seed LDAP admin cred before smbd
- Pinned storage group to GID 997 to match LDAP posixGroup
- Renamed ylw to ye-lw21 across all hosts (users.nix, skydick, xlab-gateway)
- Removed legacy tmpfiles and NFS exports (share/backup/torrent/vm destroyed)
- Added bootstrap LDIF for sambaDomain, storage group, machines OU

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: equalize ldx and ylw permissions ...

- Add ylw to NOPASSWD sudo rule (matching ldx for deploy-rs)
- Add ldx hashedPassword on xlab-gateway (matching ylw)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

users: unify ylw as common admin, keep host-specific passwords and groups ...

Move ylw base identity (isNormalUser, wheel, SSH key) to modules/users.nix
alongside ldx. Host configs retain only extra groups and hashedPassword.
Also renames ye-lw21 to ylw on skydick.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: fix ylw user missing isNormalUser and add wheel group ...

Co-Authored-By: Claude Opus 4.6 <[email protected]>

add ylw user to xlab-gateway

xlab-gateway: add ULA route for internal IPv6 reachability ...

Route fd99:23eb:1682::/48 via wg-to-wgnet in main table so
xlab-gateway and LAN clients can reach 10.0.0.1's IPv6
(fd99:23eb:1682::1). Without this, ULA traffic went through
the WAN default route and got dropped.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

refactor xlab-gateway IPv6: /64 SLAAC, scoped policy routing, no NAT66 ...

- Change LAN prefix from fd99:23eb:1682:fd:df::/80 to fd99:23eb:1682:1::/64
- Switch from DHCPv6 stateful to SLAAC (AdvAutonomous on, AdvManagedFlag off)
- Add RDNSS in radvd pointing to fd99:23eb:1682::1
- Scope policy routing rules to LAN sources only (fixes gateway IPv6 breakage)
- Remove NAT66 masquerade on wg-to-wgnet (10.0.0.1 routes fd99:23eb:1682:1::/64 natively)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

fix nftables syntax: use meta nfproto ipv6 in inet table ...

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: route client IPv6 through wg-to-wgnet ...

- Re-add IPv6 default route (::/0) via wg-to-wgnet in table 1002
- Add NAT66 masquerade on wg-to-wgnet for client ULA→tunnel translation
- Campus WAN has no IPv6 transit; wgnet provides it

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: fix IPv6 routing, clean up table names ...

- Remove IPv6 default route from freedom table (1002) — wgnet peer
  doesn't forward IPv6, causing TLS resets on outbound connections
- Remove Tsinghua IPv6 throw route (unnecessary without IPv6 default)
- IPv6 now uses native WAN path instead of WireGuard tunnel
- Rename table 1002 from typo 'wg-to-skywme' to 'freedom-wgnet'

Co-Authored-By: Claude Opus 4.6 <[email protected]>

xlab-gateway: add hardware-configuration.nix, disable wait-online ...

- Import generated hardware-configuration.nix (Intel CPU microcode,
  boot modules for ehci_pci, ahci, nvme, kvm-intel)
- Disable systemd-networkd-wait-online (gateway doesn't need to block
  boot waiting for WireGuard interfaces)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Add agenix-encrypted secrets and flake.lock ...

- Encrypted WireGuard keys for xlab-gateway (wgnet, skyworks, warp)
- Encrypted WireGuard PSK for wg-to-wgnet
- Placeholder skydick WireGuard secret
- Updated disko.nix with correct NVMe disk ID (MEMPEK1J016GAD)
- Generated flake.lock pinning nixpkgs 24.11, disko, agenix, deploy-rs

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Initial skyworks infrastructure flake ...

Unified NixOS configuration for skydick (storage server) and
xlab-gateway (lab router). Flat module structure with shared
common/users/ssh modules, agenix secrets, disko, and deploy-rs.

Co-Authored-By: Claude Opus 4.6 <[email protected]>