services/router: init

modules/dns/acme-gw-secret.nix

@@ -1,17 +0,0 @@
-# Shared TSIG secret for a gateway's dedicated ACME key (function: machine
-# name -> module). The acme_gw_<x> key lets that gateway — and only it — write
-# _acme-challenge.<label> TXT records on ns1 to obtain its internal wildcard
-# cert via DNS-01. ns1 scopes it with a matching acl on the cnx.network zone.
-# Import on BOTH ns1 and the gateway machine, applied with the machine name:
-#   (import ../../modules/dns/acme-gw-secret.nix "gw-cnx-1")
-machine:
-{ pkgs, ... }:
-{
-  clan.core.vars.generators."dns-acme-${machine}-secret" = {
-    share = true;
-    files."secret".secret = true;
-    runtimeInputs = [ pkgs.openssl ];
-    # 32 random bytes, base64 — a valid hmac-sha256 TSIG secret.
-    script = ''openssl rand -base64 32 | tr -d '\n' > "$out"/secret'';
-  };
-}

modules/dns/authoritative.nix

@@ -6,7 +6,10 @@
 }:
 let
   # ZeroTier addresses — zone transfers run over the mesh, not the public net.
-  mesh = import ../mesh-hosts.nix { inherit config lib; };
+  mesh = import ../mesh-hosts.nix {
+    dir = config.clan.core.settings.directory;
+    inherit lib;
+  };
   ns1zt = mesh.hosts.ns1;
   ns2zt = mesh.hosts.ns2;
 in