fix: keep systemd-resolved enabled on both hosts

network.nix

@@ -1,5 +1,4 @@
 {
-  config,
   inputs,
   lib,
   pkgs,
@@ -8,14 +7,14 @@
 let
   latest = import inputs.nixpkgs-latest {
     inherit (pkgs.stdenv.hostPlatform) system;
-    config = pkgs.config;
+    inherit (pkgs) config;
   };
 in
 {
-  # NetworkManager owns local DNS on workstations. With dhcpcd (EC2),
-  # NixOS wires resolvconf to resolved. Preserve both hosts' existing behavior.
+  # Keep resolvectl available on both hosts. NixOS wires NetworkManager and
+  # /etc/resolv.conf to resolved; DHCP/VPNs still supply the upstream DNS.
   services.resolved = {
-    enable = lib.mkDefault (!config.networking.networkmanager.enable);
+    enable = true;
     settings.Resolve = {
       LLMNR = false;
       MulticastDNS = false;
@@ -23,6 +22,15 @@ in
     };
   };
 
+  # The NixOS module enables resolved at boot. Retry exits without a start limit.
+  systemd.services.systemd-resolved = {
+    unitConfig.StartLimitIntervalSec = 0;
+    serviceConfig = {
+      Restart = "always";
+      RestartSec = "5s";
+    };
+  };
+
   # Local, opt-in SOCKS client only. Keep the daemon on the system package pin.
   # No relay/exit, control listener, transparent proxy or host DNS changes.
   services.tor = {