From fc07d96dd849a749b08d0d033bcd5e4545500e04 Mon Sep 17 00:00:00 2001 From: "nekomimi.pet" Date: Wed, 7 Oct 2026 19:40:47 -0400 Subject: [PATCH] focalor: bridge the onboard NIC by MAC (now enp5s0) with 10.0.0.43 on br0, plain DNS to 10.0.0.210 --- hosts/focalor/modules/llama-cpp.nix | 4 +- hosts/focalor/modules/network.nix | 61 +++++++++++++++++------------ 2 files changed, 37 insertions(+), 28 deletions(-) diff --git a/hosts/focalor/modules/llama-cpp.nix b/hosts/focalor/modules/llama-cpp.nix index 91794a7..27a5f38 100644 --- a/hosts/focalor/modules/llama-cpp.nix +++ b/hosts/focalor/modules/llama-cpp.nix @@ -13,7 +13,7 @@ in options.modules.llama-cpp.enable = lib.mkEnableOption "the llama.cpp Gemma service"; config = lib.mkIf cfg.enable { - networking.firewall.interfaces.enp4s0.allowedTCPPorts = [ 8080 ]; + networking.firewall.interfaces.br0.allowedTCPPorts = [ 8080 ]; systemd.services.llama-gemma = { description = "Gemma 4 12B Unified via llama.cpp"; @@ -41,7 +41,7 @@ in Group = "users"; WorkingDirectory = "/home/regent"; ExecStart = '' - /home/regent/Developer/llama.cpp-gemma4/build-cuda-gcc14/bin/llama-server -m /home/regent/models/gemma-4-12b-unsloth-2026-07-17/gemma-4-12b-it-Q4_K_M.gguf --mmproj /home/regent/models/gemma-4-12b-unsloth-2026-07-17/mmproj-F16.gguf --lora-scaled ${loraAdapter}:0.5 --model-draft /home/regent/models/gemma-4-12b/gemma-4-12B-it-qat-assistant-MTP-Q8_0.gguf --spec-type draft-mtp --spec-draft-n-max 4 --alias gemma-4-12b,gemma4 --host 10.0.0.13 --port 8080 --device CUDA0 --split-mode none --n-gpu-layers all --ctx-size 12288 --flash-attn on --parallel 1 --threads 2 --threads-batch 4 --batch-size 2048 --ubatch-size 512 --cont-batching --jinja --reasoning off --cache-ram 0 --metrics --no-webui + /home/regent/Developer/llama.cpp-gemma4/build-cuda-gcc14/bin/llama-server -m /home/regent/models/gemma-4-12b-unsloth-2026-07-17/gemma-4-12b-it-Q4_K_M.gguf --mmproj /home/regent/models/gemma-4-12b-unsloth-2026-07-17/mmproj-F16.gguf --lora-scaled ${loraAdapter}:0.5 --model-draft /home/regent/models/gemma-4-12b/gemma-4-12B-it-qat-assistant-MTP-Q8_0.gguf --spec-type draft-mtp --spec-draft-n-max 4 --alias gemma-4-12b,gemma4 --host 10.0.0.43 --port 8080 --device CUDA0 --split-mode none --n-gpu-layers all --ctx-size 12288 --flash-attn on --parallel 1 --threads 2 --threads-batch 4 --batch-size 2048 --ubatch-size 512 --cont-batching --jinja --reasoning off --cache-ram 0 --metrics --no-webui ''; Restart = "on-failure"; RestartSec = "5s"; diff --git a/hosts/focalor/modules/network.nix b/hosts/focalor/modules/network.nix index 53e396e..0a1f828 100644 --- a/hosts/focalor/modules/network.nix +++ b/hosts/focalor/modules/network.nix @@ -1,3 +1,9 @@ +let + # The onboard igb port. Its PCI slot (and so its kernel name) moved from enp4s0 + # to enp5s0 on 2026-10-07, so match it by MAC. The router leases 10.0.0.43 to + # this MAC, so br0 takes the same MAC and the router and the host agree. + lanMac = "a8:a1:59:94:5a:ba"; +in { networking = { hostName = "focalor"; @@ -15,49 +21,51 @@ 3002 ]; }; + # networkd owns the wired LAN; NetworkManager stays for the desktop applet. networkmanager = { enable = true; unmanaged = [ - "interface-name:enp5s0" + "mac:${lanMac}" "interface-name:br0" + "interface-name:vm-*" ]; - # enp5s0 is passed through to a VM; the host uplink is enp4s0. - ensureProfiles.profiles.focalor-lan = { - connection = { - id = "focalor-lan"; - type = "ethernet"; - interface-name = "enp4s0"; - uuid = "d891edf5-5fc7-5bda-b008-0abe8b8b5edf"; - autoconnect-priority = 100; - }; - ipv4 = { - method = "auto"; - addresses = "10.0.0.13/32"; - }; - ipv6.method = "auto"; - }; }; }; systemd.network = { enable = true; - wait-online.extraArgs = [ "--interface=enp4s0" ]; + wait-online.extraArgs = [ "--interface=br0" ]; netdevs.br0.netdevConfig = { Name = "br0"; Kind = "bridge"; + MACAddress = lanMac; }; networks = { "10-lan" = { - matchConfig.Name = [ - "enp5s0" - "vm-*" - ]; + matchConfig.PermanentMACAddress = lanMac; + networkConfig = { + Bridge = "br0"; + DHCP = "no"; + LinkLocalAddressing = "no"; + IPv6AcceptRA = false; + }; + }; + "10-lan-vms" = { + matchConfig.Name = "vm-*"; networkConfig.Bridge = "br0"; }; "10-lan-bridge" = { matchConfig.Name = "br0"; - networkConfig.IPv6AcceptRA = true; - linkConfig.RequiredForOnline = "no"; + networkConfig = { + Address = [ "10.0.0.43/24" ]; + Gateway = "10.0.0.1"; + DNS = [ + "10.0.0.210" + "1.1.1.1" + ]; + IPv6AcceptRA = true; + }; + linkConfig.RequiredForOnline = "routable"; }; }; }; @@ -70,16 +78,17 @@ useRoutingFeatures = "both"; extraUpFlags = [ "--login-server=https://vpn.klbr.net" ]; }; + # 10.0.0.210 answers plain DNS only, so DNS-over-TLS would skip it (as on valefar). resolved = { enable = true; settings.Resolve = { - DNSSEC = "true"; + DNSSEC = "false"; Domains = [ "~." ]; FallbackDNS = [ "10.0.0.210" - "1.0.0.1#one.one.one.one" + "1.1.1.1" ]; - DNSOverTLS = "true"; + DNSOverTLS = "false"; }; }; }; -- 2.54.0