Switch LXC targets from NetworkManager to systemd-networkd

boot.isContainer disables services.udev, which NetworkManager depends on
to enumerate devices — this left NM unable to reliably manage the
container veth, breaking DHCP-hostname registration in Pi-hole. It also
defaulted networking.useHostResolvConf to true, which assumes a
systemd-nspawn-style resolv.conf bind-mount that real Proxmox LXC doesn't
provide (nixpkgs' own proxmox-lxc.nix module forces this false for the
same reason). Also guard the networkmanager extraGroups membership in the
minimal/gui build-types, since that group only exists when NM is enabled.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

modules/build-types/gui.nix

@@ -38,7 +38,10 @@
     pulse.enable = true;
   };
 
-  users.users.nixos.extraGroups = [ "networkmanager" ];
+  # The networkmanager group only exists when NM is actually enabled — the
+  # lxc platform module force-disables it, so don't add the user to a group
+  # that won't exist there.
+  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
 
   programs.firefox.enable = true;
 

modules/build-types/minimal.nix

@@ -1,9 +1,12 @@
-{ pkgs, ... }:
+{ lib, pkgs, config, ... }:
 
 {
   networking.networkmanager.enable = true;
 
-  users.users.nixos.extraGroups = [ "networkmanager" ];
+  # The networkmanager group only exists when NM is actually enabled — the
+  # lxc platform module force-disables it, so don't add the user to a group
+  # that won't exist there.
+  users.users.nixos.extraGroups = lib.mkIf config.networking.networkmanager.enable [ "networkmanager" ];
 
   environment.systemPackages = with pkgs; [
     inetutils

modules/platforms/lxc.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ lib, ... }:
 
 {
   boot.isContainer = true;
@@ -11,4 +11,20 @@
   # file doesn't correctly launch the current generation, so even a
   # correctly-installed system can fail to come up after reboot.
   boot.loader.initScript.enable = true;
+
+  # boot.isContainer disables services.udev (see nixpkgs'
+  # virtualisation/container-config.nix), and NetworkManager depends on a
+  # running udevd to enumerate/classify devices. That leaves NM unable to
+  # reliably manage the container's veth interface, which is what broke
+  # DHCP-hostname registration in Pi-hole. systemd-networkd talks to the
+  # kernel over rtnetlink directly and doesn't have that dependency.
+  networking.networkmanager.enable = lib.mkForce false;
+  networking.useNetworkd = true;
+
+  # container-config.nix also defaults this to true, which assumes a
+  # systemd-nspawn-style host bind-mount of /etc/resolv.conf. Real Proxmox
+  # LXC doesn't do that (nixpkgs' own virtualisation/proxmox-lxc.nix module
+  # forces this false for the same reason), so leaving it true silently
+  # breaks DNS instead of falling back to networkd/DHCP-provided servers.
+  networking.useHostResolvConf = lib.mkForce false;
 }