From 71242e93f11e18d3f2c35075a59a62844267f9aa Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 11:39:52 +0100
Subject: [PATCH 1/3] replace nixpkgs.json with flake.lock

---
 krebs/krops.nix         |  6 +++---
 krebs/nixpkgs.json      | 12 ------------
 krebs/update-nixpkgs.sh |  9 ---------
 3 files changed, 3 insertions(+), 24 deletions(-)
 delete mode 100644 krebs/nixpkgs.json
 delete mode 100755 krebs/update-nixpkgs.sh

diff --git a/krebs/krops.nix b/krebs/krops.nix
index aeb2413a4..ad277ac86 100644
--- a/krebs/krops.nix
+++ b/krebs/krops.nix
@@ -10,8 +10,8 @@
   krebs-source = { test ? false }: rec {
     nixpkgs = if test then {
       derivation = let
-        rev = (lib.importJSON ./nixpkgs.json).rev;
-        sha256 = (lib.importJSON ./nixpkgs.json).sha256;
+        rev = (lib.importJSON ../flake.lock).nodes.nixpkgs.locked.rev;
+        sha256 = (lib.importJSON ./nixpkgs.json).nixpkgs.locked.narHash;
       in ''
         with import (builtins.fetchTarball {
           url = "https://github.com/nixos/nixpkgs/archive/${rev}.tar.gz";
@@ -27,7 +27,7 @@
     } else {
       git = {
         ref = (lib.importJSON ./nixpkgs.json).rev;
-        url = https://github.com/NixOS/nixpkgs;
+        url = "https://github.com/NixOS/nixpkgs";
         shallow = true;
       };
     };
diff --git a/krebs/nixpkgs.json b/krebs/nixpkgs.json
deleted file mode 100644
index 0b6021ed0..000000000
--- a/krebs/nixpkgs.json
+++ /dev/null
@@ -1,12 +0,0 @@
-{
-  "url": "https://github.com/NixOS/nixpkgs",
-  "rev": "9075cba53e86dc318d159aee55dc9a7c9a4829c1",
-  "date": "2023-09-02T08:28:47+02:00",
-  "path": "/nix/store/605bv7zssv38j0ii8rbnxkv1m0f0b53p-nixpkgs",
-  "sha256": "0kymzp32d31c0hny2b2f7zfn49nzrxlm963xbm4v0axka6abym36",
-  "hash": "sha256-ZlS/lFGzK7BJXX2YVGnP3yZi3T9OLOEtBCyMJsb91U8=",
-  "fetchLFS": false,
-  "fetchSubmodules": false,
-  "deepClone": false,
-  "leaveDotGit": false
-}
diff --git a/krebs/update-nixpkgs.sh b/krebs/update-nixpkgs.sh
deleted file mode 100755
index 465548f44..000000000
--- a/krebs/update-nixpkgs.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-dir=$(dirname $0)
-oldrev=$(cat $dir/nixpkgs.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
-nix-shell -p nix-prefetch-git --run 'nix-prefetch-git \
-  --url https://github.com/NixOS/nixpkgs \
-  --rev refs/heads/nixos-23.05' \
-> $dir/nixpkgs.json
-newrev=$(cat $dir/nixpkgs.json | jq -r .rev | sed 's/\(.\{7\}\).*/\1/')
-git commit $dir/nixpkgs.json -m "nixpkgs: $oldrev -> $newrev"

From 2b4e68d1e3b20f6a377dda6151c7fd8aee47d759 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 11:42:15 +0100
Subject: [PATCH 2/3] update flake.lock

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 7ca0c5f9b..6fba339f5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -18,11 +18,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1693844670,
-        "narHash": "sha256-t69F2nBB8DNQUWHD809oJZJVE+23XBrth4QZuVd6IE0=",
+        "lastModified": 1702151865,
+        "narHash": "sha256-9VAt19t6yQa7pHZLDbil/QctAgVsA66DLnzdRGqDisg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3c15feef7770eb5500a4b8792623e2d6f598c9c1",
+        "rev": "666fc80e7b2afb570462423cb0e1cf1a3a34fedd",
         "type": "github"
       },
       "original": {

From cc61ce408000c5ac87602f96b26fcb04ea5c174b Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 9 Jan 2024 00:59:13 +0100
Subject: [PATCH 3/3] sync-containers3: fix dns issues

---
 krebs/3modules/sync-containers3.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/krebs/3modules/sync-containers3.nix b/krebs/3modules/sync-containers3.nix
index d3a65bd4c..7373592a5 100644
--- a/krebs/3modules/sync-containers3.nix
+++ b/krebs/3modules/sync-containers3.nix
@@ -58,6 +58,8 @@ in {
             pkgs.jq
           ];
           networking.useDHCP = lib.mkForce true;
+          networking.useHostResolvConf = false;
+          services.resolved.enable = true;
           systemd.services.autoswitch = {
             environment = {
               NIX_REMOTE = "daemon";
@@ -297,9 +299,6 @@ in {
     (lib.mkIf (cfg.containers != {}) {
       # networking
 
-      # needed because otherwise we lose local dns
-      environment.etc."resolv.conf".source = lib.mkForce "/run/systemd/resolve/resolv.conf";
-
       boot.kernel.sysctl."net.ipv4.ip_forward" = lib.mkForce 1;
       systemd.network.networks.ctr0 = {
         name = "ctr0";
@@ -312,6 +311,9 @@ in {
           ConfigureWithoutCarrier = true;
           DHCPServer = "yes";
         };
+        dhcpServerConfig = {
+          DNS = "9.9.9.9";
+        };
       };
       systemd.network.netdevs.ctr0.netdevConfig = {
         Kind = "bridge";
@@ -344,6 +346,12 @@ in {
 
       networking.useHostResolvConf = false;
       networking.useNetworkd = true;
+      services.resolved = {
+        enable = true;
+        extraConfig = ''
+          Domains=~.
+        '';
+      };
       systemd.network = {
         enable = true;
         networks.eth0 = {