nixos/routing-common: Working DHCP

lib/constants.nix

@@ -10,12 +10,14 @@ rec {
       gitea-runner = 401;
       jellyseerr = 402;
       atticd = 403;
+      kea = 404;
     };
     gids = {
       matrix-syncv3 = 400;
       gitea-runner = 401;
       jellyseerr = 402;
       atticd = 403;
+      kea = 404;
     };
   };
 
@@ -180,14 +182,17 @@ rec {
       hi = {
         v4 = subnet 4 1 all.v4;
         v6 = subnet 4 1 all.v6;
+        mtu = hiMTU;
       };
       lo = {
         v4 = subnet 3 1 all.v4;
         v6 = subnet 4 2 all.v6;
+        mtu = 1500;
       };
       untrusted = {
         v4 = subnet 6 16 all.v4;
         v6 = subnet 4 3 all.v6;
+        mtu = 1500;
       };
       inherit (colony.prefixes) as211024;
     };

lib/default.nix

@@ -4,7 +4,7 @@ let
   inherit (lib)
     genAttrs mapAttrsToList filterAttrsRecursive nameValuePair types
     mkOption mkOverride mkForce mkIf mergeEqualOption optional
-    showWarnings concatStringsSep flatten unique;
+    showWarnings concatStringsSep flatten unique optionalAttrs;
   inherit (lib.flake) defaultSystems;
 in
 rec {
@@ -152,6 +152,9 @@ rec {
       LLDP = true;
       EmitLLDP = "customer-bridge";
     };
+    linkConfig = optionalAttrs (a.mtu != null) {
+      MTUBytes = toString a.mtu;
+    };
     ipv6AcceptRAConfig = {
       Token = mkIf (a.ipv6.iid != null) "static:${a.ipv6.iid}";
       UseDNS = true;

nixos/boxes/castle/default.nix

@@ -17,13 +17,9 @@ in
           mask = 22;
           gateway = null;
         };
-      };
-      lo = {
-        inherit domain;
-        ipv4 = {
-          address = net.cidr.host 40 prefixes.lo.v4;
-          mask = 21;
-          gateway = null;
+        ipv6 = {
+          iid = "::3:1";
+          address = net.cidr.host (65536*3+1) prefixes.hi.v6;
         };
       };
     };
@@ -108,7 +104,13 @@ in
           blueman.enable = true;
         };
 
-        programs.virt-manager.enable = true;
+        programs = {
+          virt-manager.enable = true;
+          wireshark = {
+            enable = true;
+            package = pkgs.wireshark-qt;
+          };
+        };
         virtualisation.libvirtd.enable = true;
 
         networking = {
@@ -147,7 +149,6 @@ in
             wait-online.enable = false;
             netdevs = mkMerge [
               (mkVLAN "lan-hi" vlans.hi)
-              (mkVLAN "lan-lo" vlans.lo)
             ];
             links = {
               "10-et2.5g" = {
@@ -169,28 +170,23 @@ in
             networks = {
               "50-lan" = {
                 matchConfig.Name = "et2.5g";
-                DHCP = "yes";
+                DHCP = "no";
+                address = [ "10.16.7.1/16" ];
               };
 
               "50-et100g" = {
                 matchConfig.Name = "et100g";
-                vlan = [ "lan-hi" "lan-lo" ];
+                vlan = [ "lan-hi" ];
                 networkConfig.IPv6AcceptRA = false;
               };
               "60-lan-hi" = mkMerge [
                 (networkdAssignment "lan-hi" assignments.hi)
                 {
+                  DHCP = "yes";
                   matchConfig.Name = "lan-hi";
                   linkConfig.MTUBytes = "9000";
                 }
               ];
-              "60-lan-lo" = mkMerge [
-                (networkdAssignment "lan-lo" assignments.lo)
-                {
-                  matchConfig.Name = "lan-lo";
-                  linkConfig.MTUBytes = "1500";
-                }
-              ];
             };
           };
         };

nixos/boxes/colony/vms/estuary/bgp.nix

@@ -204,14 +204,15 @@ in
             neighbor 2001:7f8:10f::1b1b:154 as 6939;
           }
 
-          protocol bgp upstream4_fogixp_efero from upstream_bgp4 {
-            description "efero transit (on FogIXP, IPv4)";
-            neighbor 185.1.147.107 as 208431;
-          }
-          protocol bgp upstream6_fogixp_efero from upstream_bgp6 {
-            description "efero transit (on FogIXP, IPv6)";
-            neighbor 2001:7f8:ca:1::107 as 208431;
-          }
+          # Not working so well lately...
+          # protocol bgp upstream4_fogixp_efero from upstream_bgp4 {
+          #   description "efero transit (on FogIXP, IPv4)";
+          #   neighbor 185.1.147.107 as 208431;
+          # }
+          # protocol bgp upstream6_fogixp_efero from upstream_bgp6 {
+          #   description "efero transit (on FogIXP, IPv6)";
+          #   neighbor 2001:7f8:ca:1::107 as 208431;
+          # }
 
           protocol bgp peer4_cc_luje from peer_bgp4 {
             description "LUJE.net (on ColoClue, IPv4)";

nixos/boxes/home/palace/default.nix

@@ -2,7 +2,7 @@
 let
   inherit (lib.my) net mkVLAN;
   inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.home) domain vlans prefixes vips;
+  inherit (lib.my.c.home) domain vlans prefixes vips hiMTU;
 in
 {
   imports = [ ./vms ];
@@ -15,15 +15,21 @@ in
     assignments = {
       hi = {
         inherit domain;
+        mtu = hiMTU;
         ipv4 = {
           address = net.cidr.host 22 prefixes.hi.v4;
           mask = 22;
           gateway = vips.hi.v4;
         };
+        ipv6 = {
+          iid = "::2:1";
+          address = net.cidr.host (65536*2+1) prefixes.hi.v6;
+        };
       };
       core = {
         inherit domain;
         name = "palace-core";
+        mtu = 1500;
         ipv4 = {
           address = net.cidr.host 20 prefixes.core.v4;
           gateway = null;
@@ -131,7 +137,7 @@ in
                 };
                 linkConfig = {
                   Name = "et100g";
-                  MTUBytes = "9000";
+                  MTUBytes = toString hiMTU;
                 };
               };
             };
@@ -169,17 +175,7 @@ in
                   MACAddress=52:54:00:8a:8a:f2
                 '';
               };
-              "60-lan-hi" = mkMerge [
-                (networkdAssignment "lan-hi" assignments.hi)
-                {
-                  matchConfig.Name = "lan-hi";
-                  linkConfig.MTUBytes = "9000";
-                  networkConfig.DNS = [
-                    (allAssignments.stream.hi.ipv4.address)
-                    # (allAssignments.river.hi.ipv4.address)
-                  ];
-                }
-              ];
+              "60-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
             };
           };
         };

nixos/boxes/home/palace/vms/cellar/default.nix

@@ -2,7 +2,7 @@
 let
   inherit (lib.my) net;
   inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.home) domain prefixes vips;
+  inherit (lib.my.c.home) domain prefixes vips hiMTU;
 in
 {
   nixos.systems.cellar = {
@@ -12,11 +12,16 @@ in
     assignments = {
       hi = {
         inherit domain;
+        mtu = hiMTU;
         ipv4 = {
           address = net.cidr.host 80 prefixes.hi.v4;
           mask = 22;
           gateway = vips.hi.v4;
         };
+        ipv6 = {
+          iid = "::4:1";
+          address = net.cidr.host (65536*4+1) prefixes.hi.v6;
+        };
       };
     };
 
@@ -66,23 +71,12 @@ in
               links = {
                 "10-lan-hi" = {
                   matchConfig.PermanentMACAddress = "52:54:00:cc:3e:70";
-                  linkConfig = {
-                    Name = "lan-hi";
-                    MTUBytes = "9000";
-                  };
+                  linkConfig.Name = "lan-hi";
                 };
               };
 
               networks = {
-                "80-vms" = mkMerge [
-                  (networkdAssignment "lan-hi" assignments.hi)
-                  {
-                    networkConfig.DNS = [
-                      (allAssignments.stream.hi.ipv4.address)
-                      (allAssignments.river.hi.ipv4.address)
-                    ];
-                  }
-                ];
+                "80-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
               };
             };
 

nixos/boxes/home/palace/vms/default.nix

@@ -69,7 +69,8 @@
       in
       {
         requires = [ vtapUnit ];
-        after = [ vtapUnit ];
+        after = [ vtapUnit "vm@cellar.service" ];
+        bindsTo = [ "vm@cellar.service" ];
         preStart = ''
           until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.cellar.hi.ipv4.address} 22; do
             sleep 1

nixos/boxes/home/routing-common/default.nix

@@ -3,9 +3,10 @@ let
   inherit (builtins) elemAt;
   inherit (lib.my) net mkVLAN;
   inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.home) domain vlans prefixes routers routersPubV4;
+  inherit (lib.my.c.home) domain vlans prefixes vips routers routersPubV4;
 
   name = elemAt routers index;
+  otherIndex = 1 - index;
 in
 {
   nixos.systems."${name}" = {
@@ -19,14 +20,16 @@ in
       core = {
         name = "${name}-core";
         inherit domain;
+        mtu = 1500;
         ipv4 = {
           address = net.cidr.host (index + 1) prefixes.core.v4;
           gateway = null;
         };
       };
       hi = {
-        inherit domain;
         name = "${name}-hi";
+        inherit domain;
+        mtu = 9000;
         ipv4 = {
           address = net.cidr.host (index + 1) prefixes.hi.v4;
           mask = 22;
@@ -37,6 +40,7 @@ in
       lo = {
         name = "${name}-lo";
         inherit domain;
+        mtu = 1500;
         ipv4 = {
           address = net.cidr.host (index + 1) prefixes.lo.v4;
           mask = 21;
@@ -47,6 +51,7 @@ in
       untrusted  = {
         name = "${name}-ut";
         inherit domain;
+        mtu = 1500;
         ipv4 = {
           address = net.cidr.host (index + 1) prefixes.untrusted.v4;
           mask = 24;
@@ -66,6 +71,33 @@ in
       };
     };
 
+    extraAssignments = {
+      router-hi.hi = {
+        name = "router-hi";
+        inherit domain;
+        ipv4 = {
+          address = vips.hi.v4;
+          mask = 22;
+        };
+        ipv6.address = vips.hi.v6;
+      };
+      router-lo.lo = {
+        name = "router-lo";
+        inherit domain;
+        ipv4 = {
+          address = vips.lo.v4;
+          mask = 21;
+        };
+        ipv6.address = vips.lo.v6;
+      };
+      router-ut.untrusted = {
+        name = "router-ut";
+        inherit domain;
+        ipv4.address = vips.untrusted.v4;
+        ipv6.address = vips.untrusted.v6;
+      };
+    };
+
     configuration = { lib, pkgs, config, assignments, allAssignments, ... }:
       let
         inherit (lib) mkIf mkMerge mkForce;
@@ -76,6 +108,8 @@ in
         imports = map (m: import m index) [
           ./keepalived.nix
           ./dns.nix
+          ./radvd.nix
+          ./kea.nix
         ];
 
         config = {
@@ -157,7 +191,7 @@ in
 
             networks =
             let
-              mkVLANConfig = name: mtu:
+              mkVLANConfig = name:
               let
                 iface = "lan-${name}";
               in
@@ -165,26 +199,9 @@ in
                 "60-${iface}" = mkMerge [
                   (networkdAssignment iface assignments."${name}")
                   {
-                    linkConfig.MTUBytes = toString mtu;
+                    dns = [ "127.0.0.1" "::1" ];
                     domains = [ config.networking.domain ];
-                    networkConfig = {
-                      IPv6AcceptRA = mkForce false;
-                      # IPv6SendRA = true;
-                    };
-                    ipv6SendRAConfig = {
-                      DNS = [
-                        (net.cidr.host 1 prefixes."${name}".v4)
-                        (net.cidr.host 2 prefixes."${name}".v4)
-                        (net.cidr.host 1 prefixes."${name}".v6)
-                        (net.cidr.host 2 prefixes."${name}".v6)
-                      ];
-                      Domains = [ config.networking.domain ];
-                    };
-                    ipv6Prefixes = [
-                      {
-                        ipv6PrefixConfig.Prefix = prefixes."${name}".v6;
-                      }
-                    ];
+                    networkConfig.IPv6AcceptRA = mkForce false;
                   }
                 ];
               };
@@ -255,9 +272,20 @@ in
                 ];
               }
 
-              (mkVLANConfig "hi" 9000)
-              (mkVLANConfig "lo" 1500)
-              (mkVLANConfig "untrusted" 1500)
+              (mkVLANConfig "hi")
+              (mkVLANConfig "lo")
+              (mkVLANConfig "untrusted")
+
+              {
+                "60-lan-hi" = {
+                  routes = map (r: { routeConfig = r; }) [
+                    {
+                      Destination = elemAt routersPubV4 otherIndex;
+                      Gateway = net.cidr.host (otherIndex + 1) prefixes.hi.v4;
+                    }
+                  ];
+                };
+              }
             ];
           };
 

nixos/boxes/home/routing-common/dns.nix

@@ -47,13 +47,8 @@ in
 
         settings = {
           query-local-address = [
-            # TODO: IPv6
             "0.0.0.0"
             "::"
-            # TODO: Dynamic IPv4 WAN address?
-            # assignments.internal.ipv4.address
-            # assignments.internal.ipv6.address
-            # assignments.hi.ipv6.address
           ];
           forward-zones = map (z: "${z}=127.0.0.1:5353") authZones;
 
@@ -73,9 +68,10 @@ in
       pdns.serviceConfig.RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
     };
 
-    # For rec_control
     environment.systemPackages = with pkgs; [
+      # For rec_control
       pdns-recursor
+      sqlite
     ];
 
     my.pdns.auth = {
@@ -98,11 +94,15 @@ in
         webserver = true;
         webserver-address = "::";
         webserver-allow-from = [ "127.0.0.1" "::1" ];
+
+        dnsupdate = true;
+        launch = [ "gsqlite3" ];
+        gsqlite3-database = "/var/lib/pdns/dynamic.sqlite3";
       };
 
       bind.zones =
       let
-        names = [ "core" "hi" "lo" ];
+        names = [ "core" "hi" "lo" "untrusted" ];
         i = toString (index + 1);
       in
       {
@@ -136,13 +136,22 @@ in
             ns1 IN ALIAS ${elemAt routers 0}.${config.networking.domain}.
             ns2 IN ALIAS ${elemAt routers 1}.${config.networking.domain}.
 
+            dyn IN NS ns1.dyn.h.nul.ie.
+            dyn IN NS ns2.dyn.h.nul.ie.
+            ns1.dyn.h.nul.ie. IN ALIAS ${elemAt routers 0}.${config.networking.domain}.
+            ns2.dyn.h.nul.ie. IN ALIAS ${elemAt routers 1}.${config.networking.domain}.
+
             jim-core IN A ${net.cidr.host 10 prefixes.core.v4}
             jim IN A ${net.cidr.host 10 prefixes.hi.v4}
+            jim IN AAAA ${net.cidr.host (65536+1) prefixes.hi.v6}
             jim-lo IN A ${net.cidr.host 10 prefixes.lo.v4}
+            jim-lo IN AAAA ${net.cidr.host (65536+1) prefixes.lo.v6}
 
             dave-core IN A ${net.cidr.host 11 prefixes.core.v4}
             dave IN A ${net.cidr.host 11 prefixes.hi.v4}
+            dave IN AAAA ${net.cidr.host (65536+2) prefixes.hi.v6}
             dave-lo IN A ${net.cidr.host 11 prefixes.lo.v4}
+            dave-lo IN AAAA ${net.cidr.host (65536+2) prefixes.lo.v6}
 
             ups IN A ${net.cidr.host 20 prefixes.lo.v4}
             palace-kvm IN A ${net.cidr.host 21 prefixes.lo.v4}

nixos/boxes/home/routing-common/kea.nix

@@ -0,0 +1,141 @@
+index: { lib, pkgs, assignments, ... }:
+let
+  inherit (lib) mkForce;
+  inherit (lib.my) net;
+  inherit (lib.my.c.home) domain prefixes vips;
+
+  dns-servers = [
+    {
+      ip-address = net.cidr.host 1 prefixes.core.v4;
+      port = 5353;
+    }
+    {
+      ip-address = net.cidr.host 2 prefixes.core.v4;
+      port = 5353;
+    }
+  ];
+in
+{
+  users = with lib.my.c.ids; {
+    users.kea= {
+      isSystemUser = true;
+      uid = uids.kea;
+      group = "kea";
+    };
+    groups.kea.gid = gids.kea;
+  };
+
+  systemd.services = {
+    kea-dhcp4-server.serviceConfig.DynamicUser = mkForce false;
+    kea-dhcp-ddns-server.serviceConfig.DynamicUser = mkForce false;
+  };
+
+  services = {
+    kea = {
+      dhcp4 = {
+        enable = true;
+        settings = {
+          interfaces-config = {
+            interfaces = [
+              "lan-hi/${assignments.hi.ipv4.address}"
+              "lan-lo/${assignments.lo.ipv4.address}"
+              "lan-untrusted/${assignments.untrusted.ipv4.address}"
+            ];
+          };
+          lease-database = {
+            type = "memfile";
+            persist = true;
+            name = "/var/lib/kea/dhcp.leases";
+          };
+
+          option-data = [
+            {
+              name = "domain-name";
+              data = domain;
+            }
+            {
+              name = "domain-search";
+              data = "${domain}, dyn.${domain}";
+              always-send = true;
+            }
+          ];
+          subnet4 = [
+            {
+              id = 1;
+              subnet = prefixes.hi.v4;
+              interface = "lan-hi";
+              option-data = [
+                {
+                  name = "routers";
+                  data = vips.hi.v4;
+                }
+                {
+                  name = "domain-name-servers";
+                  data = "${net.cidr.host 1 prefixes.hi.v4}, ${net.cidr.host 2 prefixes.hi.v4}";
+                }
+              ];
+              pools = [
+                {
+                  pool = "192.168.68.120 - 192.168.71.240";
+                }
+              ];
+              reservations = [
+                {
+                  # castle
+                  hw-address = "24:8a:07:a8:fe:3a";
+                  ip-address = net.cidr.host 40 prefixes.hi.v4;
+                }
+              ];
+            }
+            {
+              id = 2;
+              subnet = prefixes.lo.v4;
+              interface = "lan-lo";
+              option-data = [
+                {
+                  name = "routers";
+                  data = vips.lo.v4;
+                }
+                {
+                  name = "domain-name-servers";
+                  data = "${net.cidr.host 1 prefixes.lo.v4}, ${net.cidr.host 2 prefixes.lo.v4}";
+                }
+              ];
+              pools = [
+                {
+                  pool = "192.168.72.120 - 192.168.79.240";
+                }
+              ];
+              reservations = [
+                {
+                  # castle
+                  hw-address = "24:8a:07:a8:fe:3a";
+                  ip-address = net.cidr.host 40 prefixes.lo.v4;
+                }
+              ];
+            }
+          ];
+          ddns-send-updates = true;
+          ddns-replace-client-name = "when-not-present";
+          ddns-qualifying-suffix = "dyn.${domain}";
+          ddns-generated-prefix = "ip";
+          ddns-update-on-renew = true;
+
+          dhcp-ddns.enable-updates = true;
+        };
+      };
+
+      dhcp-ddns = {
+        enable = true;
+        settings = {
+          forward-ddns.ddns-domains = [
+            {
+              name = "dyn.${domain}.";
+              inherit dns-servers;
+            }
+          ];
+        };
+      };
+    };
+  };
+}

nixos/boxes/home/routing-common/keepalived.nix

@@ -1,20 +1,30 @@
-index: { lib, pkgs, ... }:
+index: { lib, pkgs, config, ... }:
 let
-  inherit (builtins) attrNames;
+  inherit (builtins) attrNames concatMap;
+  inherit (lib) optional;
   inherit (lib.my) net;
   inherit (lib.my.c.home) prefixes vips;
 
   vlanIface = vlan: if vlan == "as211024" then vlan else "lan-${vlan}";
-  vrrpIPs = family: map (vlan: {
-    addr = "${vips.${vlan}.${family}}/${toString (net.cidr.length prefixes.${vlan}.${family})}";
+  vrrpIPs = family: concatMap (vlan: [
+    {
+      addr = "${vips.${vlan}.${family}}/${toString (net.cidr.length prefixes.${vlan}.${family})}";
+      dev = vlanIface vlan;
+    }
+  ] ++ (optional (family == "v6") {
+    addr = "fe80::1/64";
     dev = vlanIface vlan;
-  }) (attrNames vips);
+  })) (attrNames vips);
   mkVRRP = family: routerId: {
     state = if index == 0 then "MASTER" else "BACKUP";
     interface = "lan-core";
     priority = 255 - index;
     virtualRouterId = routerId;
     virtualIps = vrrpIPs family;
+    extraConfig = ''
+      notify_master "${config.systemd.package}/bin/systemctl start radvd.service"
+      notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service"
+    '';
   };
 in
 {

nixos/boxes/home/routing-common/radvd.nix

@@ -0,0 +1,28 @@
+index: { lib, pkgs, ... }:
+let
+  inherit (lib) mkForce concatMapStringsSep;
+  inherit (lib.my) net;
+  inherit (lib.my.c.home) domain prefixes;
+
+  mkInterface = name: ''
+    interface lan-${name} {
+      AdvSendAdvert on;
+      AdvRASrcAddress { fe80::1; };
+      AdvLinkMTU ${toString prefixes."${name}".mtu};
+      prefix ${prefixes."${name}".v6} {};
+      RDNSS ${net.cidr.host 1 prefixes."${name}".v6} ${net.cidr.host 2 prefixes."${name}".v6} {};
+      DNSSL ${domain} {};
+     };
+  '';
+in
+{
+  # To be started by keepalived
+  systemd.services.radvd.wantedBy = mkForce [ ];
+
+  services = {
+    radvd = {
+      enable = true;
+      config = concatMapStringsSep "\n" mkInterface [ "hi" "lo" "untrusted" ];
+    };
+  };
+}

nixos/default.nix

@@ -100,6 +100,7 @@ let
       altNames = mkOpt' (listOf str) [ ] "Extra names to assign.";
       visible = mkBoolOpt' true "Whether or not this assignment should be visible.";
       domain = mkOpt' (nullOr str) null "Domain for this assignment.";
+      mtu = mkOpt' (nullOr ints.unsigned) null "Interface MTU.";
       ipv4 = {
         address = mkOpt' net.types.ipv4 null "IPv4 address.";
         mask = mkOpt' ints.u8 24 "Network mask.";

nixos/modules/common.nix

@@ -125,7 +125,6 @@ in
       environment.systemPackages = with pkgs; mkMerge [
         [
           bash-completion
-          vim
           git
           unzip
         ]
@@ -138,6 +137,7 @@ in
         fish.enable = mkDefault true;
         # TODO: This is expecting to look up the channel for the database...
         command-not-found.enable = mkDefault false;
+        vim.defaultEditor = true;
       };
 
       services = {

nixos/modules/pdns.nix

@@ -268,6 +268,9 @@ in
         # For pdns_control etc
         systemPackages = with pkgs; [
           pdns
+          (pkgs.writeShellScriptBin "pu" ''
+            ${pdns}/bin/pdnsutil --config-dir /run/pdns "$@"
+          '')
           pdns-file-record
         ];
 

nixos/modules/spdk.nix

@@ -1,7 +1,7 @@
 { lib, pkgs, config, ... }:
 let
   inherit (builtins) toJSON;
-  inherit (lib) optional mapAttrsToList mkIf withFeature;
+  inherit (lib) optional optionalAttrs mapAttrsToList mkIf withFeature;
   inherit (lib.my) mkOpt' mkBoolOpt';
 
   rpcOpts = with lib.types; {
@@ -17,7 +17,7 @@ let
       inherit subsystem;
       config = map (rpc: {
         inherit (rpc) method;
-      } // (if rpc.params != { } then { inherit (rpc) params; } else { })) c;
+      } // (optionalAttrs (rpc.params != { }) { inherit (rpc) params; })) c;
     }) cfg.config.subsystems;
   };
   configJSON = pkgs.writeText "spdk-config.json" (toJSON config');

nixos/modules/tmproot.nix

@@ -466,6 +466,16 @@ in
       (mkIf config.virtualisation.libvirtd.enable {
         my.tmproot.persistence.config.directories = [ "/var/lib/libvirt" ];
       })
+      (mkIf (with config.services.kea; (dhcp4.enable || dhcp6.enable || dhcp-ddns.enable)) {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/var/lib/kea";
+            mode = "0750";
+            user = "kea";
+            group = "kea";
+          }
+        ];
+      })
     ]))
   ]);
 

nixos/modules/user.nix

@@ -37,7 +37,8 @@ in
             extraGroups =
               [ "wheel" "kvm" "dialout" ] ++
               (optional config.networking.networkmanager.enable "networkmanager") ++
-              (optional config.virtualisation.libvirtd.enable "libvirtd");
+              (optional config.virtualisation.libvirtd.enable "libvirtd") ++
+              (optional config.programs.wireshark.enable "wireshark");
             password = mkIf (cfg.passwordSecret == null) (mkDefault "hunter2");
             shell =
               let shell = cfg.homeConfig.my.shell;