services/router: init

machines/ns1/configuration.nix

@@ -6,7 +6,10 @@
 }:
 let
   domains = import ../../modules/dns/domains.nix;
-  mesh = import ../../modules/mesh-hosts.nix { inherit config lib; };
+  mesh = import ../../modules/mesh-hosts.nix {
+    dir = config.clan.core.settings.directory;
+    inherit lib;
+  };
   hosts = import ../../modules/hosts.nix;
 in
 {
@@ -14,7 +17,8 @@ in
     ../../modules/dns/authoritative.nix
     ../../modules/dns/acme-mx1-secret.nix
     ../../modules/dns/acme-web01-secret.nix
-    (import ../../modules/dns/acme-gw-secret.nix "gw-cnx-1")
+    # Same shared TSIG secret the gateway's router service declares (proxy).
+    (import ../../modules/clan/router/acme-secret.nix "gw-cnx-1")
     ../../modules/static-ipv6.nix
     ../../modules/monitoring/exporters.nix
   ];