nixos/portcullis: Bring up 10G on the home hi VLAN

portcullis is wired over 10G to fergal, which uplinks to jim's spare
SFP+ port. That uplink is untagged VLAN 1, so hi is carried tagged on a
lan-hi VLAN interface: a static assignment at 192.168.68.41 / ::6:1,
resolving through the router VIPs like any other hi client. Its gateway
route outranks the DHCP default, making 10G the preferred path while the
2.5G bootstrap stays as a fallback. Deploy now targets that address.

The hi MTU goes on the .network rather than the .link, since a .link is
only applied at udev device-add -- with it there, et10g-0 stays at 1500
across a switch and lan-hi cannot take 9000.

jim's sfp-spare was tagged into hi and lo out of band to match.

fergal turns out to belong with portcullis rather than to the home
fabric -- it goes to Nikhef when the box does -- so its documentation
moves to the colony site, leaving home/switches.md a short section on
what it borrows from that fabric.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

nixos/boxes/colony/portcullis/default.nix

@@ -1,6 +1,8 @@
 { lib, ... }:
 let
+  inherit (lib.my) net;
   inherit (lib.my.c.colony) domain;
+  home = lib.my.c.home;
 in
 {
   nixos.systems.portcullis = {
@@ -8,7 +10,29 @@ in
     nixpkgs = "mine-stable";
     home-manager = "mine-stable";
 
-    configuration = { lib, pkgs, config, ... }:
+    assignments = {
+      # Staging-only: the 10G link lands on the home hi VLAN until portcullis is racked.
+      hi = {
+        domain = home.domain;
+        mtu = home.hiMTU;
+        ipv4 = {
+          address = net.cidr.host 41 home.prefixes.hi.v4;
+          mask = 22;
+          gateway = home.vips.hi.v4;
+        };
+        ipv6 = {
+          iid = "::6:1";
+          address = net.cidr.host (65536*6+1) home.prefixes.hi.v6;
+        };
+      };
+    };
+
+    configuration = { lib, pkgs, config, assignments, ... }:
+      let
+        inherit (lib) mkMerge;
+        inherit (lib.my) mkVLAN networkdAssignment;
+        inherit (lib.my.c) networkd;
+      in
       {
         hardware = {
           enableRedistributableFirmware = true;
@@ -54,10 +78,12 @@ in
         ];
 
         systemd.network = {
-          # Only one port is patched in while the box is being staged, so don't block
+          # Only some ports are patched in while the box is being staged, so don't block
           # boot on the others coming up.
           wait-online.anyInterface = true;
 
+          netdevs = mkVLAN "lan-hi" home.vlans.hi;
+
           links = {
             "10-et2g5-0" = {
               matchConfig.PermanentMACAddress = "00:d0:b4:05:ed:48";
@@ -88,8 +114,8 @@ in
 
           networks = {
             # TODO: replace with the colony assignments and routing config once portcullis is
-            # racked at Nikhef. Until then it is staged on the home lo VLAN, so every 2.5G port
-            # takes DHCP and whichever one is patched in provides connectivity. kea registers
+            # racked at Nikhef. Until then it is staged at home, so every 2.5G port takes DHCP on
+            # the lo VLAN and whichever one is patched in provides connectivity. kea registers
             # the DHCP hostname, making the box reachable as `portcullis.dyn.h.nul.ie`.
             "80-bootstrap" = {
               matchConfig.Name = "et2g5-*";
@@ -97,12 +123,29 @@ in
               networkConfig.IPv6PrivacyExtensions = "no";
               linkConfig.RequiredForOnline = "routable";
             };
+
+            # 10G up to jim's spare SFP+ port via an intermediary switch. That uplink is
+            # untagged VLAN 1, so hi has to be tagged on its own interface.
+            "81-et10g-0" = {
+              matchConfig.Name = "et10g-0";
+              vlan = [ "lan-hi" ];
+              networkConfig = networkd.noL3;
+              linkConfig = {
+                # The carrier has to allow hi's jumbo frames before lan-hi can take that MTU
+                MTUBytes = toString home.hiMTU;
+                RequiredForOnline = "no";
+              };
+            };
+            "82-lan-hi" = mkMerge [
+              (networkdAssignment "lan-hi" assignments.hi)
+              { networkConfig = home.vlanDns "hi"; }
+            ];
           };
         };
 
         my = {
-          # As above: no colony assignment yet, so point deploy at the staging DHCP name.
-          deploy.node.hostname = "portcullis.dyn.${lib.my.c.home.domain}";
+          # As above: no colony assignment yet, so deploy over the staging hi address.
+          deploy.node.hostname = assignments.hi.ipv4.address;
 
           secrets = {
             key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAUolR93Byg+Daw8pUYHVpQ34ioxSc2C8vzj9F4KbqMs";