From 80ddb2efc927c894074558f0a8f13377bb934cb4 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 7 Jan 2026 17:25:27 +0100
Subject: [PATCH 1/2] router: enable a DHCP server for the v4-NAT network as
 well

As the hosts don't really need a static v4, just do DHCP.
---
 resources/chaosknoten/router/nftables/nftables.conf         | 2 +-
 .../router/systemd_networkd/21-net0.2-v4_nat.network        | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/resources/chaosknoten/router/nftables/nftables.conf b/resources/chaosknoten/router/nftables/nftables.conf
index 6d04a4c..3375bfb 100644
--- a/resources/chaosknoten/router/nftables/nftables.conf
+++ b/resources/chaosknoten/router/nftables/nftables.conf
@@ -45,7 +45,7 @@ table inet host {
         tcp dport 22 accept comment "allow ssh access"
 
         # Allow DHCP server access.
-		iifname $if_net0_3_ci_runner udp dport 67 accept comment "allow dhcp server access"
+		iifname { $if_net0_2_v4_nat, $if_net0_3_ci_runner } udp dport 67 accept comment "allow dhcp server access"
     }
 }
 
diff --git a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
index c7fd9a7..b15259d 100644
--- a/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
+++ b/resources/chaosknoten/router/systemd_networkd/21-net0.2-v4_nat.network
@@ -11,6 +11,12 @@ Description=v4-NAT
 # Masquerading done in nftables (nftables.conf).
 IPv6SendRA=yes
 
+DHCPServer=true
+
+[DHCPServer]
+PoolOffset=100
+PoolSize=150
+
 [Address]
 Address=10.32.2.1/24
 

From fbd3ea54962e7b0348c9ccb4471f493c26002322 Mon Sep 17 00:00:00 2001
From: June <june@jsts.xyz>
Date: Wed, 7 Jan 2026 18:09:48 +0100
Subject: [PATCH 2/2] base_config: disable cloud-init ssh module to avoid
 hostkey regeneration

It should run once on first boot anyway and since it apparently runs for
every change in the Proxmox cloud init config, disable it, so it
doesn't, since it's annoying to have "random" hostkey changes.
---
 roles/base_config/tasks/main.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 roles/base_config/tasks/main.yaml

diff --git a/roles/base_config/tasks/main.yaml b/roles/base_config/tasks/main.yaml
new file mode 100644
index 0000000..cd8affd
--- /dev/null
+++ b/roles/base_config/tasks/main.yaml
@@ -0,0 +1,13 @@
+# Ensure the ssh module is disabled, so a cloud-init config change doesn't regenerate the host keys for no reason.
+- name: check if cloud-init config file exists
+  ansible.builtin.stat:
+    path: /etc/cloud/cloud.cfg
+  register: base_config__stat_cloud_cfg
+
+- name: ensure the cloud-init ssh module is disabled
+  ansible.builtin.replace:
+    path: /etc/cloud/cloud.cfg
+    regexp: " - ssh$"
+    replace: " #- ssh"
+  become: true
+  when: base_config__stat_cloud_cfg.stat.exists