1 files changed, 78 insertions, 8 deletions

diff --git a/os/core/networking.nix b/os/core/networking.nix
index 22fc206..d50d899 100644
--- a/os/core/networking.nix
+++ b/os/core/networking.nix
@@ -19,21 +19,72 @@ in
       default = "client";
       description = "Which networking profile configuration to apply";
     };
+
+    lan = lib.mkOption {
+      description = "Physical Home Local Area Network configuration parameters.";
+      type = lib.types.submodule {
+        options = {
+          ip = lib.mkOption {
+            type = lib.types.str;
+            default = "10.0.0.2";
+            description = "The local static or leased IP assigned to this machine on the home network.";
+          };
+          range = lib.mkOption {
+            type = lib.types.str;
+            default = "10.0.0.0/8";
+            description = "The broader subnet block representing the physical home network.";
+          };
+        };
+      };
+    };
+
+    wg = lib.mkOption {
+      description = "Standard WireGuard VPN tunnel configuration parameters.";
+      type = lib.types.submodule {
+        options = {
+          ip = lib.mkOption {
+            type = lib.types.str;
+            default = "10.3.0.1";
+            description = "The explicit tunnel IP address assigned to this machine's WireGuard interface.";
+          };
+          range = lib.mkOption {
+            type = lib.types.str;
+            default = "10.3.0.0/24";
+            description = "The total addressable IP space assigned to the WireGuard network pool.";
+          };
+        };
+      };
+    };
+
+    hs = lib.mkOption {
+      description = "Headscale mesh overlay network configuration parameters.";
+      type = lib.types.submodule {
+        options = {
+          ip = lib.mkOption {
+            type = lib.types.str;
+            default = "10.4.0.1";
+            description = "The explicit mesh network IP address assigned to this machine via Headscale.";
+          };
+          range = lib.mkOption {
+            type = lib.types.str;
+            default = "10.4.0.0/24";
+            description = "The full mesh overlay allocation subnet block.";
+          };
+        };
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable (
     lib.mkMerge [
       {
-        networking.networkmanager = {
-          enable = true;
-          dns = "systemd-resolved";
-        };
-
         services.resolved.enable = true;
       }
 
       (lib.mkIf (cfg.profile == "client") {
         networking.networkmanager = {
+          enable = true;
+          dns = "systemd-resolved";
           wifi.macAddress = "random";
           wifi.backend = "iwd";
           ethernet.macAddress = "random";
@@ -47,9 +98,28 @@ in
       })
 
       (lib.mkIf (cfg.profile == "server") {
-        networking.networkmanager = {
-          wifi.macAddress = "keep";
-          ethernet.macAddress = "keep";
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+        };
+        systemd.network = {
+          enable = true;
+
+          netdevs."10-br-srv" = {
+            netdevConfig = {
+              Name = "br-srv";
+              Kind = "bridge";
+            };
+          };
+          networks."20-host-management" = {
+            matchConfig.Name = "br-srv";
+            address = [ "10.0.0.2/24" ];
+            gateway = [ "10.0.0.1" ];
+            networkConfig.LinkLocalAddressing = "no";
+          };
+        };
+        boot.kernel.sysctl = {
+          "net.ipv4.ip_nonlocal_bind" = 1;
         };
       })
     ]