Add authoritative DNS on ns1/ns2 and finalize clan config

- Knot authoritative DNS: ns1 primary, ns2 secondary serving cnx.network,
  buildfor.life and cnx.email over TSIG-secured zone transfer (modules/dns)
- Knot listens publicly + over ZeroTier; firewall opens port 53
- Complete clan inventory: name/domain, admin SSH key, control as the
  zerotier controller, tor on all nixos machines
- Enable age yubikey/fido2-hmac secret plugins

clan.nix

@@ -1,58 +1,33 @@
 {
   # Ensure this is unique among all clans you want to use.
-  meta.name = "__CHANGE_ME__";
-  meta.domain = "changeme";
+  meta.name = "cnx-network-clan";
+  meta.domain = "cnx-network.internal";
 
   inventory.machines = {
-    # Define machines here.
-    # jon = { };
+	control = {};
+	ns1 = {};
+	ns2 = {};
   };
 
-  # Docs: See https://docs.clan.lol/services/definition/
   inventory.instances = {
 
-    # Docs: https://docs.clan.lol/services/official/admin/
-    # Admin service for managing machines
-    # This service adds a root password and SSH access.
     admin = {
       roles.default.tags.all = { };
       roles.default.settings.allowedKeys = {
-        # Insert the public key that you want to use for SSH access.
-        # All keys will have ssh access to all machines ("tags.all" means 'all machines').
-        # Alternatively set 'users.users.root.openssh.authorizedKeys.keys' in each machine
-        "admin-machine-1" = "__YOUR_PUBLIC_KEY__";
+        "berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENAjhGQGraQoAjJzsomKP8GAmQPeGL1rNRNHgRcLqtT";
       };
     };
 
-    # Docs: https://docs.clan.lol/services/official/zerotier/
-    # The lines below will define a zerotier network and add all machines as 'peer' to it.
-    # !!! Manual steps required:
-    #   - Define a controller machine for the zerotier network.
-    #   - Deploy the controller machine first to initialize the network.
     zerotier = {
-      # Replace with the name (string) of your machine that you will use as zerotier-controller
-      # See: https://docs.zerotier.com/controller/
-      # Deploy this machine first to create the network secrets
-      roles.controller.machines."__YOUR_CONTROLLER__" = { };
-      # Peers of the network
-      # tags.all means 'all machines' will joined
+      roles.controller.machines."control" = { };
       roles.peer.tags.all = { };
     };
 
-    # Docs: https://docs.clan.lol/services/official/tor/
-    # Tor network provides secure, anonymous connections to your machines
-    # All machines will be accessible via Tor as a fallback connection method
     tor = {
       roles.server.tags.nixos = { };
     };
   };
 
-  # Additional NixOS configuration can be added here.
-  # machines/jon/configuration.nix will be automatically imported.
-  # See: https://docs.clan.lol/guides/inventory/autoincludes/
   machines = {
-    # jon = { config, ... }: {
-    #   environment.systemPackages = [ pkgs.asciinema ];
-    # };
   };
 }