nixos/home/routing-common: Add MSS clamping to work around PMTUD

nixos/boxes/home/routing-common/default.nix

@@ -226,7 +226,7 @@ in
                   extraConfig = ''
                     [CAKE]
                     Bandwidth=235M
-                    RTTSec=10ms
+                    RTTSec=50ms
                     PriorityQueueingPreset=besteffort
                     # DOCSIS preset
                     OverheadBytes=18
@@ -250,7 +250,7 @@ in
                       [CAKE]
                       Parent=root
                       Bandwidth=24M
-                      RTTSec=1ms
+                      RTTSec=50ms
                     '';
                   }
                 ];
@@ -370,6 +370,12 @@ in
                     return
                   }
 
+                  chain forward-early {
+                    type filter hook forward priority -1; policy accept;
+
+                    # MSS clamping to workaround IPv6 PMTUD being broken...
+                    tcp flags syn tcp option maxseg size set rt mtu counter
+                  }
                   chain forward {
                     ${lib.my.c.as211024.nftTrust}
                     iifname lan-untrusted jump filter-untrusted

nixos/boxes/home/routing-common/kea.nix

@@ -26,7 +26,11 @@ in
   };
 
   systemd.services = {
-    kea-dhcp4-server.serviceConfig.DynamicUser = mkForce false;
+    kea-dhcp4-server.serviceConfig = {
+      # Sometimes interfaces might not be ready in time and Kea doesn't like that
+      Restart = "on-failure";
+      DynamicUser = mkForce false;
+    };
     kea-dhcp-ddns-server.serviceConfig.DynamicUser = mkForce false;
   };