From 58c40292e20d47002e343ed3a91a8c8b6843a8d8 Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Mon, 27 Jul 2026 14:02:41 +1000
Subject: [PATCH] fix(pxe-boot): move dnsmasq out of systemd.services into
 services.dnsmasq

dnsmasq config was placed inside systemd.services{} block, making Nix
interpret it as systemd.services.dnsmasq.settings (which doesn't exist).
Move to top-level services.dnsmasq and add UDP 67 to firewall for DHCP
proxy mode.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 modules/build-types/pxe-boot.nix | 42 +++++++++++++++-----------------
 1 file changed, 20 insertions(+), 22 deletions(-)

diff --git a/modules/build-types/pxe-boot.nix b/modules/build-types/pxe-boot.nix
index d3626d7..5006c7d 100644
--- a/modules/build-types/pxe-boot.nix
+++ b/modules/build-types/pxe-boot.nix
@@ -417,30 +417,28 @@ in
           ExecStart = stageSystemRescue;
         };
       };
-      dnsmasq = {
-        enable = true;
-        settings = {
-          # Proxy mode: respond only to PXE DHCP requests, leave normal leases to router
-          dhcp-range = [ "192.168.2.0,proxy" ];
-          # iPXE client detection
-          dhcp-match = [
-            "set:ipxe,175"
-            "set:efi64,option:client-arch,7"
-            "set:efi64,option:client-arch,9"
-          ];
-          dhcp-userclass = "set:ipxe,iPXE";
-          # Boot file selection
-          dhcp-boot = [
-            "tag:ipxe,tag:efi64,http://${vars.pxeServerIp}/boot.ipxe"
-            "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe"
-            "tag:efi64,ipxe.efi,,${vars.pxeServerIp}"
-            "undionly.kpxe,,${vars.pxeServerIp}"
-          ];
-        };
-      };
+    };
+  };
+
+  services.dnsmasq = {
+    enable = true;
+    settings = {
+      dhcp-range = [ "192.168.2.0,proxy" ];
+      dhcp-match = [
+        "set:ipxe,175"
+        "set:efi64,option:client-arch,7"
+        "set:efi64,option:client-arch,9"
+      ];
+      dhcp-userclass = "set:ipxe,iPXE";
+      dhcp-boot = [
+        "tag:ipxe,tag:efi64,http://${vars.pxeServerIp}/boot.ipxe"
+        "tag:ipxe,http://${vars.pxeServerIp}/boot.ipxe"
+        "tag:efi64,ipxe.efi,,${vars.pxeServerIp}"
+        "undionly.kpxe,,${vars.pxeServerIp}"
+      ];
     };
   };
 
   networking.firewall.allowedTCPPorts = [ vars.ports.pxeBootHttp ];
-  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp 67 ];
 }