networking fixes

common/network/pia-vpn/vpn-container.nix

@@ -51,6 +51,9 @@ let
 in
 {
   config = mkIf cfg.enable {
+    # Give the container more time to boot (pia-vpn-setup retries can delay readiness)
+    systemd.services."container@pia-vpn".serviceConfig.TimeoutStartSec = "180s";
+
     containers.pia-vpn = {
       autoStart = true;
       ephemeral = true;
@@ -157,7 +160,7 @@ in
               connectToServer '${wgFile}' '${cfg.interfaceName}'
 
               # 4. Default route through WG
-            ip route add default dev ${cfg.interfaceName}
+              ip route replace default dev ${cfg.interfaceName}
               echo "Default route set through ${cfg.interfaceName}"
 
               # 5. NAT: masquerade bridge → WG (so service containers' traffic appears to come from VPN IP)