port the static IP section, and offer the actual fix for the reboot-changes-IP problem

Homelab only, as it should always have been. On a vps the provider's DHCP is
authoritative and already stable, and pinning an address there is how an instance
is stranded; on dev the machine moves between networks and a fixed address is the
opposite of what is wanted. Both say so rather than skipping quietly.

The more useful change is that a static address is no longer the only answer
offered, because it is not the right one for the problem it was added to solve.

A fresh Ubuntu box taking a new IP on every reboot is not the router
misbehaving. systemd-networkd's ClientIdentifier defaults to `duid` — man
systemd.network is explicit — so the machine introduces itself to DHCP with an
RFC 4361 client ID built from an IAID and a DUID. This host shows it:

    DHCP4 Client ID: IAID:0x56504d98/DUID

Consumer routers key leases and reservations on the MAC. The two never match, so
the router does not recognise the machine as one it has seen and hands out the
next free address — and a reservation pinned to the MAC is never honoured, which
is the part that makes the router look broken.

`dhcp-identifier: mac` in netplan sets ClientIdentifier=mac and the router sees
what it expects. DHCP keeps working, reservations start being honoured, and
nothing is pinned on the machine. That is now the first option, with the static
address second and still carrying the original's warnings.

It is written as its own 99- netplan file and merged with whatever the installer
or cloud-init already wrote, rather than this script parsing and rewriting their
YAML. Deliberately NOT applied: it takes effect at the next reboot, which is the
moment the problem shows up anyway, so there is nothing to gain by dropping the
network now. `netplan generate` validates before either file is kept, and the
file is removed again if it does not.

Found and fixed while testing: dhcp_client_identifier parsed the value with
awk -F': *' and took field 2 — but the value is itself "IAID:0x…/DUID", so the
split yielded "IAID", the DUID test failed, and the helper reported "mac" on a
machine that was plainly sending a DUID. It would have told the user the opposite
of the truth about their own problem. Reads everything after the first colon now.

Verified on this host: correctly reports duid, explains why, and renders both the
homelab and vps paths.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/network.sh

@@ -106,3 +106,92 @@ EOF
 # assumed, because a resolver that does not answer is the one failure that makes
 # everything after it look broken for unrelated reasons.
 dns_works() { getent hosts one.one.one.one >/dev/null 2>&1 || getent hosts example.com >/dev/null 2>&1; }
+
+# -----------------------------------------------------------------------------
+# The address this machine gets
+# -----------------------------------------------------------------------------
+#
+# ── Why a fresh Ubuntu box takes a new IP on every reboot ──
+#
+# Not a router fault, and not something a static IP is the right answer to.
+# systemd-networkd's ClientIdentifier defaults to `duid` — an RFC 4361 client ID
+# built from an IAID and a DUID — so the machine introduces itself to DHCP by
+# that, and `networkctl status` shows it as "DHCP4 Client ID: IAID:0x…/DUID".
+#
+# Consumer routers key their leases and their reservations on the MAC address.
+# The two never match, so the router does not recognise the machine as a client
+# it has seen before and hands out the next free address instead. A reservation
+# pinned to the MAC never takes effect, which is the part that makes it look like
+# the router is broken.
+#
+# `dhcp-identifier: mac` in netplan sets ClientIdentifier=mac, and the router then
+# sees what it expects. DHCP keeps working, the reservation starts being honoured,
+# and nothing is pinned on the machine itself — which is why this is offered ahead
+# of a static address rather than beside it.
+
+NETPLAN_DHCP_ID=/etc/netplan/99-machine-setup-dhcp-identifier.yaml
+NETPLAN_STATIC=/etc/netplan/99-machine-setup-static.yaml
+
+# What the machine is sending as its DHCP identity: "mac", "duid", or empty when
+# the link is not on DHCP at all.
+dhcp_client_identifier() {
+  local iface="$1"
+  local id
+  # Everything after the FIRST colon, not field 2 of a colon split: the value is
+  # itself "IAID:0x…/DUID", so splitting on colons yields "IAID" and the DUID
+  # test silently answers backwards.
+  id="$(networkctl status "$iface" 2>/dev/null | awk '/DHCP4 Client ID/ { sub(/^[^:]*:[[:space:]]*/, ""); print; exit }')"
+  [[ -z "$id" ]] && return 0
+  if [[ "$id" == *DUID* ]]; then echo duid; else echo mac; fi
+}
+
+# Already asked for by some netplan file?
+dhcp_identifier_is_mac() { grep -rqs "dhcp-identifier:[[:space:]]*mac" /etc/netplan/ 2>/dev/null; }
+
+iface_ipv4() { ip -4 addr show "$1" 2>/dev/null | grep -oP '(?<=inet\s)\d+(\.\d+){3}/\d+' | head -1; }
+iface_gateway() { ip route | awk '/^default/ { print $3; exit }'; }
+iface_is_dhcp() { networkctl status "$1" 2>/dev/null | grep -q "DHCP4"; }
+
+# Ask for MAC-based identity, as its own netplan file.
+#
+# Netplan reads /etc/netplan in lexical order and merges, so a 99- file adds this
+# one key to whatever the installer or cloud-init already wrote, without this
+# script having to parse and rewrite their YAML.
+set_dhcp_identifier_mac() {
+  local iface="$1"
+  cat >"$NETPLAN_DHCP_ID" <<EOF
+# Written by machine-setup.
+#
+# Identify to DHCP by MAC rather than by DUID, so the router recognises this
+# machine across reboots and any reservation pinned to its MAC is honoured.
+# Merged with whatever else is in /etc/netplan; 99- so it is read last.
+network:
+  version: 2
+  ethernets:
+    ${iface}:
+      dhcp-identifier: mac
+EOF
+  chmod 600 "$NETPLAN_DHCP_ID"
+}
+
+# Freeze the current lease into a static address.
+write_static_netplan() {
+  local iface="$1" cidr="$2" gateway="$3"
+  cat >"$NETPLAN_STATIC" <<EOF
+# Written by machine-setup. Delete this file and run 'netplan apply' to go back
+# to DHCP.
+network:
+  version: 2
+  ethernets:
+    ${iface}:
+      dhcp4: false
+      addresses:
+        - ${cidr}
+      routes:
+        - to: default
+          via: ${gateway}
+EOF
+  chmod 600 "$NETPLAN_STATIC"
+}
+
+netplan_check() { netplan generate 2>&1; }