containers reach network-online only with a dhcp lease, and bao users wait for it

nix/agent-modules/bao.nix

@@ -125,7 +125,8 @@ in
   config = lib.mkIf configured {
     systemd.services.${unitName} = {
       description = "keep this agent's swarm secret store identity current, and prove it works";
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
       path = [
         pkgs.openbao

nix/agent-modules/hive-ca.nix

@@ -85,9 +85,10 @@ in
       ${unitName} = {
         description = "fetch the swarm root certificate from the secret store";
         after = [
-          "network.target"
+          "network-online.target"
           "hive-agent-bao-identity.service"
         ];
+        wants = [ "network-online.target" ];
         wantedBy = [ "multi-user.target" ];
         path = [
           pkgs.coreutils

nix/agent-modules/network.nix

@@ -25,7 +25,14 @@
   config = {
     networking.useDHCP = true;
     networking.resolvconf.enable = false;
-    networking.dhcpcd.extraConfig = "nohook resolv.conf";
+    # `noipv4ll` and `wait = "ipv4"`: dhcpcd counts an IPv4LL address as an
+    # address, so by default `network-online.target` is reached on 169.254.x
+    # before the lease arrives. With both set it waits for the lease.
+    networking.dhcpcd.extraConfig = ''
+      nohook resolv.conf
+      noipv4ll
+    '';
+    networking.dhcpcd.wait = "ipv4";
 
     # A unicast DHCP renewal reply otherwise reaches dhcpcd only by
     # matching the firewall's ESTABLISHED,RELATED conntrack rule against