nixos/boxes/home/routing-common/default.nix

@@ -226,7 +226,7 @@ in
                   extraConfig = ''
                     [CAKE]
                     Bandwidth=235M
-                    RTTSec=50ms
+                    RTTSec=10ms
                     PriorityQueueingPreset=besteffort
                     # DOCSIS preset
                     OverheadBytes=18
@@ -250,7 +250,7 @@ in
                       [CAKE]
                       Parent=root
                       Bandwidth=24M
-                      RTTSec=50ms
+                      RTTSec=1ms
                     '';
                   }
                 ];
@@ -370,12 +370,6 @@ in
                     return
                   }
 
-                  chain forward-early {
-                    type filter hook forward priority -1; policy accept;
-
-                    # MSS clamping to workaround IPv6 PMTUD being broken...
-                    tcp flags syn tcp option maxseg size set rt mtu counter
-                  }
                   chain forward {
                     ${lib.my.c.as211024.nftTrust}
                     iifname lan-untrusted jump filter-untrusted

nixos/boxes/home/routing-common/kea.nix

@@ -26,11 +26,7 @@ in
   };
 
   systemd.services = {
-    kea-dhcp4-server.serviceConfig = {
-      # Sometimes interfaces might not be ready in time and Kea doesn't like that
-      Restart = "on-failure";
-      DynamicUser = mkForce false;
-    };
+    kea-dhcp4-server.serviceConfig.DynamicUser = mkForce false;
     kea-dhcp-ddns-server.serviceConfig.DynamicUser = mkForce false;
   };