From be05c63a67ad602541b574533799a4874b3d2347 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 20 Jul 2026 01:16:29 +1000 Subject: [PATCH] Switch LXC targets from NetworkManager to systemd-networkd MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit boot.isContainer disables services.udev, which NetworkManager depends on to enumerate devices — this left NM unable to reliably manage the container veth, breaking DHCP-hostname registration in Pi-hole. It also defaulted networking.useHostResolvConf to true, which assumes a systemd-nspawn-style resolv.conf bind-mount that real Proxmox LXC doesn't provide (nixpkgs' own proxmox-lxc.nix module forces this false for the same reason). Also guard the networkmanager extraGroups membership in the minimal/gui build-types, since that group only exists when NM is enabled. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot --- modules/build-types/gui.nix | 5 ++++- modules/build-types/minimal.nix | 7 +++++-- modules/platforms/lxc.nix | 18 +++++++++++++++++- 3 files changed, 26 insertions(+), 4 deletions(-) diff --git a/modules/build-types/gui.nix b/modules/build-types/gui.nix index 4215bd4..3627f88 100644 --- a/modules/build-types/gui.nix +++ b/modules/build-types/gui.nix @@ -38,7 +38,10 @@ pulse.enable = true; }; - users.users.nixos.extraGroups = [ "networkmanager" ]; + # The networkmanager group only exists when NM is actually enabled — the + # lxc platform module force-disables it, so don't add the user to a group + # that won't exist there. + users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ]; programs.firefox.enable = true; diff --git a/modules/build-types/minimal.nix b/modules/build-types/minimal.nix index f0a0733..9853475 100644 --- a/modules/build-types/minimal.nix +++ b/modules/build-types/minimal.nix @@ -1,9 +1,12 @@ -{ pkgs, ... }: +{ lib, pkgs, config, ... }: { networking.networkmanager.enable = true; - users.users.nixos.extraGroups = [ "networkmanager" ]; + # The networkmanager group only exists when NM is actually enabled — the + # lxc platform module force-disables it, so don't add the user to a group + # that won't exist there. + users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ]; environment.systemPackages = with pkgs; [ inetutils diff --git a/modules/platforms/lxc.nix b/modules/platforms/lxc.nix index 412e3e2..2d26aae 100644 --- a/modules/platforms/lxc.nix +++ b/modules/platforms/lxc.nix @@ -1,4 +1,4 @@ -{ ... }: +{ lib, ... }: { boot.isContainer = true; @@ -11,4 +11,20 @@ # file doesn't correctly launch the current generation, so even a # correctly-installed system can fail to come up after reboot. boot.loader.initScript.enable = true; + + # boot.isContainer disables services.udev (see nixpkgs' + # virtualisation/container-config.nix), and NetworkManager depends on a + # running udevd to enumerate/classify devices. That leaves NM unable to + # reliably manage the container's veth interface, which is what broke + # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the + # kernel over rtnetlink directly and doesn't have that dependency. + networking.networkmanager.enable = lib.mkForce false; + networking.useNetworkd = true; + + # container-config.nix also defaults this to true, which assumes a + # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox + # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module + # forces this false for the same reason), so leaving it true silently + # breaks DNS instead of falling back to networkd/DHCP-provided servers. + networking.useHostResolvConf = lib.mkForce false; }