feat(networking): enable useNetworkd option for static IP configuration

hosts/vps/default.nix

@@ -14,6 +14,7 @@
   myNetworking = {
     hostName = "vps";
     useNetworkManager = false;
+    useNetworkd = true;
     staticIp = {
       interface = "ens3";
       address = "23.175.41.196";

modules/system/networking.nix

@@ -39,6 +39,12 @@ in
       description = "Whether to enable NetworkManager to manage network interfaces.";
     };
 
+    useNetworkd = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to configure the static IP via systemd-networkd instead of the classic scripted networking backend. Needed for reliable onlink default routes.";
+    };
+
     staticIp = lib.mkOption {
       type = lib.types.nullOr (lib.types.submodule {
         options = {
@@ -121,7 +127,8 @@ in
     };
   };
 
-  config = {
+  config = lib.mkMerge [
+    {
       networking = lib.mkMerge [
         {
           hostName = cfg.hostName;
@@ -132,7 +139,7 @@ in
             allowedTCPPorts = [ 22 ] ++ cfg.extraTcpPorts;
           };
         }
-      (lib.mkIf (cfg.staticIp != null) {
+        (lib.mkIf (cfg.staticIp != null && !cfg.useNetworkd) {
           useDHCP = false;
           interfaces.${cfg.staticIp.interface}.ipv4.addresses = [{
             address = cfg.staticIp.address;
@@ -140,17 +147,9 @@ in
           }];
           nameservers = cfg.staticIp.nameservers;
         })
-      (lib.mkIf (cfg.staticIp != null && !cfg.staticIp.onlinkGateway) {
+        (lib.mkIf (cfg.staticIp != null && !cfg.useNetworkd && !cfg.staticIp.onlinkGateway) {
           defaultGateway = cfg.staticIp.gateway;
         })
-      (lib.mkIf (cfg.staticIp != null && cfg.staticIp.onlinkGateway) {
-        interfaces.${cfg.staticIp.interface}.ipv4.routes = [{
-          address = "0.0.0.0";
-          prefixLength = 0;
-          via = cfg.staticIp.gateway;
-          options.onlink = "true";
-        }];
-      })
         (lib.mkIf cfg.wireguard.enable {
           wireguard.interfaces."wg-${cfg.hostName}" = {
             ips = cfg.wireguard.ips;
@@ -178,5 +177,31 @@ in
           AllowUsers = cfg.sshAllowUsers;
         };
       };
+    }
+
+    (lib.mkIf (cfg.staticIp != null && cfg.useNetworkd) {
+      networking.useDHCP = false;
+      systemd.network.enable = true;
+      services.resolved.enable = true;
+
+      systemd.network.networks."10-${cfg.staticIp.interface}" = {
+        matchConfig.Name = cfg.staticIp.interface;
+        address = [ "${cfg.staticIp.address}/${toString cfg.staticIp.prefixLength}" ];
+        dns = cfg.staticIp.nameservers;
+        routes = [
+          ({
+            routeConfig = {
+              Gateway = cfg.staticIp.gateway;
+            } // lib.optionalAttrs cfg.staticIp.onlinkGateway {
+              GatewayOnLink = true;
             };
+          })
+        ];
+        networkConfig = {
+          DHCP = "no";
+        };
+        linkConfig.RequiredForOnline = "routable";
+      };
+    })
+  ];
 }