Add site gateway role (modules/router) and gw-cnx-1

Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense:
PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl.
username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp,
Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with
the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk.

Fleet baseline rides along: admins sops group is now derived for every
machine in clan.nix (secrets encrypt to it from the first vars generate)
and time sync is chrony everywhere instead of systemd-timesyncd.

This commit is contained in:

Berwn

2026-07-28 17:06:07 +07:00

parent a87b579eb7

commit 158252323f

20 changed files with 857 additions and 31 deletions

									
										modules/mesh-hosts.nix
									
		+1
		
												View File
												
				@@ -23,6 +23,7 @@ let

				    "ns2"

				    "mx1"

				    "web01"

				    "gw-cnx-1"

				  ] readIp;

				  # RFC 4193 prefix of this ZeroTier network: fd + the 8-byte network id + the