feat(jeeves): centralize firewall configuration

- split networking into interface and firewall modules
- define named service ports in one location
- remove scattered service-level firewall rules

systems/jeeves/networking/interfaces.nix

@@ -0,0 +1,77 @@
+{
+  # Docker loads br_netfilter on jeeves. Disable bridge netfilter so
+  # br-nix-builder behaves like a pure L2 bridge and bridged traffic
+  # does not hit the host firewall/rpfilter path.
+  boot.kernel.sysctl = {
+    "net.bridge.bridge-nf-call-arptables" = 0;
+    "net.bridge.bridge-nf-call-ip6tables" = 0;
+    "net.bridge.bridge-nf-call-iptables" = 0;
+  };
+
+  systemd.network = {
+    enable = true;
+    wait-online = {
+      enable = false;
+      anyInterface = true;
+    };
+    netdevs = {
+      "20-br-nix-builder" = {
+        netdevConfig = {
+          Kind = "bridge";
+          Name = "br-nix-builder";
+        };
+      };
+      "30-internet-vlan" = {
+        netdevConfig = {
+          Kind = "vlan";
+          Name = "internet-vlan";
+        };
+        vlanConfig.Id = 100;
+      };
+    };
+    networks = {
+      # Unused second port of the onboard i350; keep it down so the dead
+      # PCIe link (see dmesg "PCIe link lost") stops logging Tx errors.
+      "01-unused-igb-port" = {
+        matchConfig.Name = "enp97s0f0";
+        linkConfig.ActivationPolicy = "always-down";
+      };
+      # Aquantia 10G card (0000:21:00.0); loses PCIe link, and its
+      # unicast RX path is dead while TX still works, so when it's up it
+      # answers ARP for the host IPs and black-holes the replies. Keep
+      # it down until the card is fixed or replaced.
+      "01-unused-atlantic-port" = {
+        matchConfig.Name = "enp33s0";
+        linkConfig.ActivationPolicy = "always-down";
+      };
+      "10-Primary" = {
+        matchConfig.Name = "enp97s0f1";
+        address = [ "192.168.99.14/24" ];
+        dns = [
+          "192.168.99.1"
+          "2600:4040:abfb:d700::1"
+        ];
+        routes = [ { Gateway = "192.168.99.1"; } ];
+        vlan = [ "internet-vlan" ];
+        dhcpV4Config.UseDNS = false;
+        dhcpV6Config.UseDNS = false;
+        ipv6AcceptRAConfig.UseDNS = false;
+        linkConfig.RequiredForOnline = "routable";
+      };
+      "50-internet-vlan" = {
+        matchConfig.Name = "internet-vlan";
+        bridge = [ "br-nix-builder" ];
+        linkConfig.RequiredForOnline = "no";
+      };
+      "60-br-nix-builder" = {
+        matchConfig.Name = "br-nix-builder";
+        bridgeConfig = { };
+        networkConfig = {
+          IPv6AcceptRA = false;
+          LinkLocalAddressing = "no";
+        };
+        linkConfig.RequiredForOnline = "no";
+      };
+    };
+  };
+}