nixos/home: Recurse over IPv4 only on the home routers

The routers' IPv6 default route runs over the as211024 mesh as a
proto-static route that blackholes rather than withdrawing when the mesh
flaps (e.g. during ipsec churn on a deploy). With "::" in the recursor's
outgoing.source_address, pdns-recursor kept selecting IPv6 to reach
authoritative servers, stalled on timeouts, and took recursion down with
it whenever the mesh bounced. Drop "::" so upstream recursion goes out
the WAN over IPv4 and stays up; AAAA records are still served fine.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/constants.nix

@@ -322,7 +322,7 @@ rec {
       "stream"
     ];
     routersPubV4 = [
-      "109.255.108.88"
+      "84.203.124.128" # river: Digiweb static
       "109.255.108.121"
     ];
 

nixos/boxes/home/palace/vms/river.nix

@@ -8,16 +8,20 @@
 
     configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
     let
+      inherit (builtins) elemAt;
       inherit (lib) mkForce mkMerge mkIf;
       inherit (lib.my) networkdAssignment mkVLAN;
       inherit (lib.my.c) networkd;
-      inherit (lib.my.c.home) vlans domain prefixes roceBootModules;
+      inherit (lib.my.c.home) vlans domain prefixes roceBootModules routersPubV4;
 
       # Digiweb currently delivers the ISP VLAN (pon-isp, 10) single-tagged, so PPPoE runs on a
       # VLAN 10 sitting directly on the physical WAN link. Flip this to true to nest it back
       # inside the wan-pon (131) transport VLAN — double-stacking also needs QinQ (tag-stacking)
       # on the switch feeding the ONT, or the BRAS never answers PADI.
       wanStacked = false;
+
+      # river is routing-common index 0; the Digiweb static IP we request via IPCP
+      pubV4 = elemAt routersPubV4 0;
     in
     {
       imports = [
@@ -92,7 +96,8 @@
                 plugin pppoe.so wan-vlan-inner
                 name "digiweb@nga.digiweb.ie"
                 password "digiweb"
-                noipdefault
+                # request our static IP as the local address in IPCP (local:remote, remote left open)
+                ${pubV4}:
                 # no usepeerdns: we ignore Digiweb's resolvers and use the local recursive resolver
                 lcp-echo-interval 1
                 lcp-echo-failure 4

nixos/boxes/home/routing-common/dns.nix

@@ -64,7 +64,13 @@ in
           };
 
           outgoing = {
-            source_address = [ "0.0.0.0" "::" ];
+            # Query authoritative servers over IPv4 only. Our IPv6 default route runs over the
+            # as211024 mesh (`ip -6 route show default`), a proto-static route that isn't
+            # withdrawn when the mesh flaps (e.g. during ipsec churn) — it just blackholes. With
+            # "::" here the recursor keeps picking IPv6 to reach NS, stalls on timeouts, and
+            # takes recursion down with it. IPv4 upstream goes out the WAN directly and stays up;
+            # we still serve AAAA records regardless of transport.
+            source_address = [ "0.0.0.0" ];
           };
 
           recursor = {