The mesh's interface takes over the found tunnel's MTU

Carries MTU from the reported tunnel (mesh-host#28) through inventory,
the overlay graph's TakeOver, into the generated config's [Interface].
A tuned path keeps its MTU across the takeover instead of regressing to
1420 and hanging transfers no ping would reveal. Two emit tests; a
tunnel with no MTU writes no line.

internal/overlay/declaration.go

@@ -130,6 +130,12 @@ func config(node Node, peers []Peer, keyPath string) string {
 		// with an endpoint — the guard's suggested remedy — breaks a NAT'd node's path.
 		fmt.Fprintf(&b, "ListenPort = %d\n", node.TakesOver.Port)
 	}
+	// The MTU the found tunnel carried, when it set one: a path tuned to 1380 (say) stalls TLS
+	// and hangs transfers if the mesh's interface comes up at the 1420 default, and no ping shows
+	// it (novox/hq: a taken tunnel carries its MTU).
+	if node.TakesOver != nil && node.TakesOver.MTU != 0 {
+		fmt.Fprintf(&b, "MTU = %d\n", node.TakesOver.MTU)
+	}
 	// The private key is set from a file the node wrote, so it never appears here and never
 	// travelled. Everything else in this file came from the mesh; this one line is the node's.
 	fmt.Fprintf(&b, "PostUp = wg set %%i private-key %s\n", keyPath)

internal/overlay/declaration_test.go

@@ -286,3 +286,26 @@ func TestANodeWithNoTunnelAndNoEndpointStillListensOnNothing(t *testing.T) {
 		t.Fatalf("a dial-only node needs no ListenPort:\n%s", config)
 	}
 }
+
+func TestATakenTunnelCarriesItsMTU(t *testing.T) {
+	// A path tuned to a smaller MTU (1380 here) must survive the takeover — the mesh interface
+	// comes up with the same MTU, or transfers hang silently (novox/hq: a taken tunnel carries
+	// its MTU).
+	config, _ := declarationFor(t, Node{
+		Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
+		TakesOver: &TakeOver{Interface: "wg0", Port: 51820, MTU: 1380},
+	}, nil)
+	if !strings.Contains(config, "MTU = 1380") {
+		t.Fatalf("the tuned MTU was dropped:\n%s", config)
+	}
+}
+
+func TestNoMTULineWhenTheTunnelSetNone(t *testing.T) {
+	config, _ := declarationFor(t, Node{
+		Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
+		TakesOver: &TakeOver{Interface: "wg0", Port: 51820},
+	}, nil)
+	if strings.Contains(config, "MTU") {
+		t.Fatalf("no MTU was found, so none should be written:\n%s", config)
+	}
+}

internal/overlay/graph.go

@@ -50,6 +50,8 @@ type TakeOver struct {
 	Interface string
 	Unit      string
 	Config    string
+	// MTU is the found tunnel's, when it set one — emitted so a tuned path keeps its MTU.
+	MTU int
 	// Port is the port the found tunnel listened on. The mesh's interface must listen on it too,
 	// even on a node that is not dialable from the hub: a home node's LAN peers dial it there
 	// (novox/hq: a taken tunnel brings its port). Listening is "a peer dials me here"; it is not