@@ -5,12 +5,15 @@ }:
 let
   hostName = "r5";
   domain = "home.arpa";
-  tailnet = "fin-marlin.ts.net";
+
+  wan = "wan0";
+  bridge = "br0";
 in
 {
   imports = [
     ../roles/home.nix
     ../roles/server.nix
+    ../roles/router.nix
   ];
   age.secrets = {
     acme.file = ../../secrets/acme.age;
@@ -18,35 +21,41 @@ syncthing.file = ../../secrets/syncthing.age;
   };
 
   networking = {
-    useDHCP = true;
     inherit domain hostName;
-    hosts = {
-      "fd7a:115c:a1e0::53" = [
-        "tailscale"
-        "ts"
-      ];
-      "192.168.100.1" = [
-        "modem"
-        "pyur"
-      ];
+    # see ../roles/router.nix for remaining settings
+    nat = {
+      externalInterface = wan;
+      internalInterfaces = [ bridge ];
     };
-    nameservers = [
-      "9.9.9.11"
-      "149.112.112.11"
-      "2620:fe::11"
-      "2620:fe::fe:11"
-    ];
-    nftables.enable = true;
   };
+
   systemd.network = {
-    enable = true;
-  };
-  services.resolved = {
-    enable = true;
-    settings.Resolve = {
-      DNS = [ ];
-      LLMNR = false;
-      MulticastDNS = true;
+    netdevs = {
+      "20-${bridge}" = {
+        netdevConfig = {
+          Kind = "bridge";
+          Name = "${bridge}";
+        };
+      };
+    };
+    networks = {
+      "30-lan1" = {
+        matchConfig.Path = "platform-3c0000000.pcie-*";
+        networkConfig.Bridge = bridge;
+        linkConfig.RequiredForOnline = "enslaved";
+      };
+      "30-lan2" = {
+        matchConfig.Path = "platform-3c0400000.pcie-*";
+        networkConfig.Bridge = bridge;
+        linkConfig.RequiredForOnline = "enslaved";
+      };
+      "40-${bridge}" = {
+        matchConfig.Name = bridge;
+        bridgeConfig = { };
+        linkConfig = {
+          RequiredForOnline = "routable";
+        };
+      };
     };
   };
 

@@ -7,12 +7,9 @@ ...
 }:
 
 let
-  wan = "wan0";
   lan = "lan0";
   hostName = "r6";
   domain = "home.arpa";
-  tailnet = "hydra-pinecone.ts.net";
-  dnsmasqEnable = true;
 in
 {
   imports = [
@@ -41,210 +38,10 @@ enable = true;
     name = "rockchip/rk3588s-nanopi-r6c.dtb";
   };
 
-  boot.kernelModules = [
-    "tcp_lp"
-  ];
-  boot.kernel.sysctl = {
-    "net.ipv6.conf.all.accept_ra" = 0;
-    "net.ipv6.conf.all.autoconf" = 0;
-    "net.ipv6.conf.all.use_tempaddr" = 0;
-
-    "net.ipv6.conf.${wan}.accept_ra" = 2;
-    "net.ipv6.conf.${wan}.autoconf" = 1;
-
-    "net.ipv4.tcp_slow_start_after_idle" = 0;
-    "net.ipv4.tcp_ecn" = 1;
-    "net.ipv4.tcp_fastopen" = "0x3";
-    "net.ipv4.tcp_allowed_congestion_control" = "reno cubic lp";
-    "net.core.default_qdisc" = "fq";
-  };
   networking = {
     useDHCP = false;
     inherit domain hostName;
-    hosts = {
-      "fd7a:115c:a1e0::53" = [
-        "tailscale"
-        "ts"
-      ];
-      "192.168.100.1" = [
-        "modem"
-        "pyur"
-      ];
-    };
-    nameservers = [
-      "9.9.9.11"
-      "149.112.112.11"
-      "2620:fe::11"
-      "2620:fe::fe:11"
-    ];
-    firewall = {
-      trustedInterfaces = [
-        lan
-        "tailscale0"
-      ];
-      filterForward = true;
-      extraForwardRules = ''
-        iifname "tailscale0" oifname "${lan}" accept
-        iifname "${lan}" oifname "tailscale0" accept
-      '';
-    };
-    nftables.enable = true;
-    nat = {
-      enable = true;
-      externalInterface = wan;
-      internalInterfaces = [
-        lan
-        "tailscale0"
-      ];
-    };
   };
-  systemd.network = {
-    enable = true;
-    config = {
-      networkConfig = {
-        IPv6Forwarding = true;
-      };
-    };
-    links = {
-      "10-${lan}" = {
-        matchConfig.Path = "platform-a40c00000.pcie-pci-0003:31:00.0";
-        linkConfig.Name = lan;
-      };
-      "10-${wan}" = {
-        matchConfig.Path = "platform-fe1c0000.ethernet";
-        linkConfig.Name = wan;
-      };
-    };
-    networks = {
-      "50-${lan}" = rec {
-        matchConfig.Name = lan;
-        address = [
-          "10.0.0.1/16"
-          "fd12:d04f:65d:42::1/56"
-        ];
-        addresses = [
-          {
-            Address = "fe80::1/64";
-            Scope = "link";
-          }
-        ];
-        networkConfig = {
-          IPv6AcceptRA = false;
-          DHCPPrefixDelegation = true;
-          ConfigureWithoutCarrier = true;
-          MulticastDNS = true;
-          Domains = [ config.networking.domain ];
-          IPv6SendRA = !dnsmasqEnable;
-          DHCPServer = !dnsmasqEnable;
-          DNS = map (a: builtins.head (lib.strings.splitString "/" a)) address;
-          DNSDefaultRoute = false;
-        };
-        dhcpPrefixDelegationConfig = {
-          UplinkInterface = wan;
-          SubnetId = "42";
-          Assign = true;
-          Token = "::1";
-        };
-        dhcpServerConfig = {
-          DefaultLeaseTimeSec = 86400;
-          MaxLeaseTimeSec = 86400;
-          DNS = "_server_address";
-          IPv6OnlyPreferredSec = 900;
-        };
-      };
-      "50-${wan}" = {
-        matchConfig.Name = wan;
-        networkConfig = {
-          DHCP = true;
-          IPv6AcceptRA = true;
-          IPv4Forwarding = true;
-          MulticastDNS = false;
-          DNSDefaultRoute = true;
-          DNSOverTLS = true;
-          DNS = map (ns: "${ns}#dns11.quad9.net") config.networking.nameservers;
-        };
-        dhcpV4Config = {
-          UseDNS = false;
-          SendHostname = false;
-          UseHostname = false;
-          Label = "${wan}:1";
-        };
-        dhcpV6Config = {
-          UseDNS = false;
-          SendHostname = false;
-          RapidCommit = true;
-          PrefixDelegationHint = "::/56";
-        };
-        dhcpPrefixDelegationConfig = {
-          UplinkInterface = ":self";
-        };
-        ipv6AcceptRAConfig = {
-          UseDNS = false;
-        };
-        addresses = [
-          {
-            Address = "192.168.100.10/24";
-            Peer = "192.168.100.1/32";
-            Label = "${wan}:0";
-            Scope = "link";
-          }
-        ];
-        cakeConfig = {
-          Bandwidth = "24M";
-          OverheadBytes = 18;
-          MPUBytes = 64;
-          CompensationMode = "none";
-          NAT = true;
-          PriorityQueueingPreset = "diffserv8";
-        };
-      };
-    };
-  };
-  services.resolved = {
-    enable = true;
-    extraConfig = ''
-      DNS =
-      LLMNR = false
-      MulticastDNS = true
-    '';
-  };
-
-  services.dnsmasq = {
-    enable = dnsmasqEnable;
-    alwaysKeepRunning = true;
-    settings = {
-      inherit domain;
-      interface = lan;
-      except-interface = "lo";
-      bind-interfaces = true;
-      dhcp-fqdn = true;
-      dhcp-authoritative = true;
-      dhcp-rapid-commit = true;
-      dhcp-range = [
-        "10.0.1.10,10.0.250.250,48h"
-        "fd12:d04f:65d:42::,slaac,ra-names,48h"
-        "::,constructor:${lan},ra-stateless"
-      ];
-      quiet-dhcp = true;
-      quiet-dhcp6 = true;
-      quiet-ra = true;
-      enable-ra = true;
-
-      cache-size = 0;
-      no-resolv = true;
-      server = [ "127.0.0.53" ];
-
-      expand-hosts = true;
-      localise-queries = true;
-      interface-name = [
-        "${hostName}.${domain},${lan}"
-        "ca.${domain},${lan}"
-        "wan.${domain},${wan}"
-      ];
-    };
-  };
-  systemd.services.dnsmasq.after = [ "network-online.target" ];
-  systemd.services.dnsmasq.wants = [ "network-online.target" ];
 
   # TODO find script
   # systemd.services.dynamic-dns-update = {

@@ -0,0 +1,207 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  wan = config.networking.nat.externalInterface;
+  lans = config.networking.nat.internalInterfaces;
+  lan = builtins.head lans;
+  inherit (config.networking) domain hostName;
+
+  dnsmasqEnable = true;
+
+  wanPrefixLen = 56;
+
+  nameservers = [
+    "9.9.9.11"
+    "149.112.112.11"
+    "2620:fe::11"
+    "2620:fe::fe:11"
+  ];
+  nsTLSHostname = "dns11.quad9.net";
+in
+{
+  networking = {
+    useDHCP = false;
+    hosts = {
+      "192.168.100.1" = [
+        "modem"
+        "pyur"
+      ];
+    };
+    inherit nameservers;
+
+    nat = {
+      enable = true;
+    };
+    firewall = {
+      enable = true;
+      trustedInterfaces = lans;
+      filterForward = true;
+    };
+    nftables = {
+      enable = true;
+    };
+  };
+
+  systemd.network = {
+    enable = true;
+    config = {
+      networkConfig = {
+        IPv6Forwarding = true;
+      };
+    };
+    networks = {
+      "40-${lan}" = rec {
+        matchConfig.Name = lan;
+        address = [
+          "10.0.0.1/16"
+          "fd12:d04f:65d:42::1/56"
+          "fe80::1/64"
+        ];
+        networkConfig = {
+          IPv6AcceptRA = false;
+          DHCPPrefixDelegation = true;
+          ConfigureWithoutCarrier = true;
+          MulticastDNS = true;
+          Domains = [ config.networking.domain ];
+          LinkLocalAddressing = false;
+          IPv6SendRA = !dnsmasqEnable;
+          DHCPServer = !dnsmasqEnable;
+          DNS = map (a: builtins.head (lib.strings.splitString "/" a)) address;
+          DNSDefaultRoute = false;
+        };
+        dhcpPrefixDelegationConfig = {
+          UplinkInterface = wan;
+          SubnetId = "42";
+          Assign = true;
+          Token = "::1";
+        };
+      };
+      "40-${wan}" = {
+        matchConfig.Name = wan;
+        networkConfig = {
+          DHCP = true;
+          IPv6AcceptRA = true;
+          IPv4Forwarding = true;
+          MulticastDNS = false;
+          DNSDefaultRoute = true;
+          DNSOverTLS = true;
+          DNS = map (ns: "${ns}#${nsTLSHostname}") config.networking.nameservers;
+        };
+        dhcpV4Config = {
+          UseDNS = false;
+          SendHostname = false;
+          UseHostname = false;
+          Label = "${wan}:1";
+        };
+        dhcpV6Config = {
+          UseDNS = false;
+          SendHostname = false;
+          RapidCommit = true;
+          PrefixDelegationHint = "::/${toString wanPrefixLen}";
+        };
+        dhcpPrefixDelegationConfig = {
+          UplinkInterface = ":self";
+        };
+        ipv6AcceptRAConfig = {
+          UseDNS = false;
+        };
+        addresses = [
+          {
+            Address = "192.168.100.10/24";
+            Peer = "192.168.100.1/32";
+            Label = "${wan}:0";
+            Scope = "link";
+          }
+        ];
+        routes = [
+          {
+            Gateway = "_dhcp4";
+            InitialCongestionWindow = 30;
+            InitialAdvertisedReceiveWindow = 30;
+          }
+          {
+            Gateway = "_ipv6ra";
+            InitialCongestionWindow = 30;
+            InitialAdvertisedReceiveWindow = 30;
+          }
+        ];
+        cakeConfig = {
+          Bandwidth = "24M";
+          OverheadBytes = 18;
+          MPUBytes = 64;
+          CompensationMode = "none";
+          NAT = true;
+          RTTSec = "100ms";
+          AckFilter = true;
+          PriorityQueueingPreset = "diffserv8";
+        };
+      };
+    };
+  };
+
+  services.resolved = {
+    enable = true;
+    settings.Resolve = {
+      DNS = [ ];
+      LLMNR = false;
+      MulticastDNS = true;
+    };
+  };
+
+  boot.kernelModules = [
+    "tcp_lp"
+  ];
+  boot.kernel.sysctl = {
+    "net.ipv4.tcp_slow_start_after_idle" = 0;
+    "net.ipv4.tcp_ecn" = 1;
+    "net.ipv4.tcp_fastopen" = "0x3";
+    "net.core.default_qdisc" = "fq";
+
+    "net.ipv6.conf.all.accept_ra" = 0;
+    "net.ipv6.conf.all.autoconf" = 0;
+    "net.ipv6.conf.all.use_tempaddr" = 0;
+
+    # "net.ipv6.conf.${wan}.accept_ra" = 2;
+    "net.ipv6.conf.${wan}.autoconf" = 1;
+  };
+
+  services.dnsmasq = {
+    enable = dnsmasqEnable;
+    alwaysKeepRunning = true;
+    settings = {
+      inherit domain;
+      interface = lan;
+      except-interface = "lo";
+      bind-interfaces = true;
+      dhcp-fqdn = true;
+      dhcp-authoritative = true;
+      dhcp-rapid-commit = true;
+      dhcp-range = [
+        "10.0.1.10,10.0.250.250,48h"
+        "fd12:d04f:65d:42::,slaac,ra-names,48h"
+        "::,constructor:${lan},ra-stateless"
+      ];
+      quiet-dhcp = true;
+      quiet-dhcp6 = true;
+      quiet-ra = true;
+      enable-ra = true;
+
+      cache-size = 0;
+      no-resolv = true;
+      server = [ "127.0.0.53" ];
+
+      expand-hosts = true;
+      localise-queries = true;
+      interface-name = [
+        "${hostName}.${domain},${lan}"
+        "ca.${domain},${lan}"
+        "wan.${domain},${wan}"
+      ];
+    };
+  };
+  systemd.services.dnsmasq.after = [ "network.target" ];
+  systemd.services.dnsmasq.wants = [ "network.target" ];
+}

@@ -1,5 +1,12 @@
 { ... }:
 {
+  networking.hosts = {
+    "fd7a:115c:a1e0::53" = [
+      "tailscale"
+      "ts"
+    ];
+  };
+
   services.tailscale = {
     enable = true;
     openFirewall = true;