nixos-module/container/vpn: allow link-local addrs for ipv6 slaac

nix/nixos-module/container/vpn.nix

@@ -40,11 +40,18 @@ in
     wireguardPeers = map ({ publicKey, allowedIPs }: {
       wireguardPeerConfig = {
         PublicKey = publicKey;
-        AllowedIPs = allowedIPs;
+        AllowedIPs = allowedIPs ++ [ "fe80::/64" "ff02::/16" ];
       };
     }) config.site.vpn.wireguard.peers;
   };
 
+  systemd.network.networks.vpn.addresses = [ {
+    addressConfig = {
+      Address = "fe80::1/64";
+      Scope = "link";
+    };
+  } ];
+
   environment.systemPackages = [
     pkgs.wireguard-tools
   ];