Networking updates. Postrun debugging info.

deploy.sh

@@ -930,15 +930,19 @@ postrun_action() {
 echo "Enrolling boot disk key to TPM..."
 
 BOOT_DISKS_ID=(${BOOT_DISKS_ID[@]})
+DEBUG=${DEBUG}
 DISK_PATH=""
 j=1
 
 for i in \${!BOOT_DISKS_ID[@]}; do
   if echo "\${BOOT_DISKS_ID[\${i}]}" | grep -iq "nvme"; then
+    [[ "\${DEBUG}" == "true" ]] && echo "NVMe detected..."
     DISK_PATH="/dev/\${BOOT_DISKS_ID[\${i}]}p2"
   else
+    [[ "\${DEBUG}" == "true" ]] && echo "Non-NVMe drive detected..."
     DISK_PATH="/dev/\${BOOT_DISKS_ID[\${i}]}2"
   fi
+  [[ "\${DEBUG}" == "true" ]] && echo "Issuing enroll command for disk \${DISK_PATH}..."
   echo ${REMOTE_PASS} | sudo -S systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+7 --unlock-key-file=/etc/secrets/disks/boot-\${j} \${DISK_PATH}
   j=\$((j + 1))
 done

templates/nix-config/configuration.nix

@@ -172,5 +172,5 @@
   # Enable auto nix-store optimization
   nix.settings.auto-optimise-store = true;
 
-  system.stateVersion = "25.05";
+  system.stateVersion = "25.11";
 }

templates/nix-config/misc/networking.nix

@@ -6,14 +6,12 @@
 
   networking.networkmanager.enable = false;
 
-  networking.nftables.enable = true;
-  networking.firewall.enable = true;
-
   # Allow rootless containers to bind to port 53 and up
   boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53;
 
   # Bridge configuration for VMs
   networking.bridges.br0.interfaces = [ "TARGET_INTERFACE" ];
+  networking.interfaces."TARGET_INTERFACE".useDHCP = false;
   networking.interfaces.br0.useDHCP = false;
   networking.nameservers = [ "HOME_SERVER_IP" "9.9.9.9" ];
   networking.interfaces.br0.ipv4.addresses = [{
@@ -25,8 +23,11 @@
     interface = "br0";
   };
 
+  networking.nftables.enable = true;
+
   # Open ports in the firewall
   networking.firewall = {
+    enable = true;
     allowPing = true;
     allowedTCPPorts = [ 53 80 443 ];
     allowedUDPPorts = [ 53 443 ];