B4L/cnx-network-clan
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Onboard mx1 mail host and factor out per-host public IPs

Browse Source 
- Register mx1 in the inventory and as a direct-SSH `internet` host; give it
  a static public IPv6 (2a01:4ff:2f0:1963::1).
- Point the cnx.email MX (plus SPF/DMARC) at mx1 and add its A record.
- Bring mx1 into monitoring: import exporters, add it to the mesh map and the
  node scrape job so its host metrics and journald reach control.
- Add a clan-mx1 Hetzner firewall: inbound SMTP + ZeroTier + ICMP, no public
  SSH (admin rides the mesh like the other hosts). 587/465/993 held for now.
- Extract per-host public IPv4/IPv6 into modules/hosts.nix, consumed by
  clan.nix's internet hosts and each machine's cnx.staticIPv6, so each address
  is declared once instead of being duplicated across configs.
- docs: add mx1 to the machines table.
This commit is contained in:
Berwn
2026-06-18 11:53:14 +07:00
parent 2c89ab913c
commit 6e4178df04
11 changed files with 94 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
machines/control/configuration.nix
+6 -2
View File
@@ -1,3 +1,7 @@
{ config, ... }:
let
hosts = import ../../modules/hosts.nix;
in
{
imports = [
../../modules/hetzner-firewall.nix
@@ -11,10 +15,10 @@
clan.core.sops.defaultGroups = [ "admins" ];
# Public IPv6; SLAAC doesn't bring it up here.
# Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
cnx.staticIPv6 = {
enable = true;
address = "2a01:4f9:c013:e6d0::1";
address = hosts.${config.networking.hostName}.ipv6;
};
time.timeZone = "Etc/GMT-3"; # UTC+3 (fixed offset, no DST)
machines/mx1/configuration.nix
+18 -2
View File
@@ -1,7 +1,23 @@
{ config, ... }:
let
hosts = import ../../modules/hosts.nix;
in
{
imports = [
../../modules/static-ipv6.nix
../../modules/monitoring/exporters.nix
];
# New machine!
clan.core.sops.defaultGroups = [ "admins" ];
# Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
cnx.staticIPv6 = {
enable = true;
address = hosts.${config.networking.hostName}.ipv6;
};
services.timesyncd.enable = true;
# Mail host backing the cnx.email MX (mx1.cnx.email -> 5.223.65.38).
# SMTP/IMAP services to be configured.
}
machines/ns1/configuration.nix
+4 -2
View File
@@ -2,6 +2,7 @@
let
domains = import ../../modules/dns/domains.nix;
mesh = import ../../modules/mesh-hosts.nix { inherit config lib; };
hosts = import ../../modules/hosts.nix;
in
{
imports = [
@@ -22,10 +23,11 @@ in
# resolution, so map the control machine name to its ZeroTier mesh address.
networking.hosts.${mesh.hosts.control} = [ "control" ];
# Public IPv6 (matches the ns1 AAAA glue); SLAAC doesn't bring it up here.
# Public IPv6 (from modules/hosts.nix; matches the ns1 AAAA glue); SLAAC
# doesn't bring it up here.
cnx.staticIPv6 = {
enable = true;
address = "2a01:4f8:c014:b5c5::1";
address = hosts.${config.networking.hostName}.ipv6;
};
time.timeZone = "Etc/GMT-1"; # UTC+1 (fixed offset, no DST)
machines/ns2/configuration.nix
+5 -3
View File
@@ -1,6 +1,7 @@
{ ... }:
{ config, ... }:
let
domains = import ../../modules/dns/domains.nix;
hosts = import ../../modules/hosts.nix;
in
{
imports = [
@@ -11,10 +12,11 @@ in
clan.core.sops.defaultGroups = [ "admins" ];
# Public IPv6 (matches the ns2 AAAA glue); SLAAC doesn't bring it up here.
# Public IPv6 (from modules/hosts.nix; matches the ns2 AAAA glue); SLAAC
# doesn't bring it up here.
cnx.staticIPv6 = {
enable = true;
address = "2a01:4f9:c014:6d87::1";
address = hosts.${config.networking.hostName}.ipv6;
};
time.timeZone = "Etc/GMT-3"; # UTC+3 (fixed offset, no DST)