From 848c4ec47d415b51157905d203f163a6f0083d12 Mon Sep 17 00:00:00 2001
From: Berwn <alexander@grabowski.email>
Date: Wed, 17 Jun 2026 11:53:56 +0700
Subject: [PATCH] Read mesh host map from clan zerotier vars instead of
 hardcoding

The control/ns1/ns2 mesh IPs and the /88 subnet were duplicated literals in
mesh-hosts.nix. clan-core's zerotier generator already writes each machine's IP
as a public var (vars/per-machine/<m>/zerotier/zerotier-ip), so read from there
and derive the subnet from zerotier-network-id. Pure refactor: the rendered
values are identical and the system derivation hash is unchanged.
---
 modules/dns/authoritative.nix    |  4 ++--
 modules/mesh-hosts.nix           | 34 +++++++++++++++++++++++---------
 modules/monitoring/exporters.nix |  2 +-
 modules/monitoring/server.nix    |  2 +-
 4 files changed, 29 insertions(+), 13 deletions(-)

diff --git a/modules/dns/authoritative.nix b/modules/dns/authoritative.nix
index f6d9d40..d5b8b82 100644
--- a/modules/dns/authoritative.nix
+++ b/modules/dns/authoritative.nix
@@ -1,7 +1,7 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 let
   # ZeroTier addresses — zone transfers run over the mesh, not the public net.
-  mesh = import ../mesh-hosts.nix;
+  mesh = import ../mesh-hosts.nix { inherit config lib; };
   ns1zt = mesh.hosts.ns1;
   ns2zt = mesh.hosts.ns2;
 in
diff --git a/modules/mesh-hosts.nix b/modules/mesh-hosts.nix
index 8696a38..0c1d96d 100644
--- a/modules/mesh-hosts.nix
+++ b/modules/mesh-hosts.nix
@@ -1,14 +1,30 @@
 # ZeroTier (clan mesh) addresses — the private IPv6 overlay every machine shares.
 # DNS zone transfers and metrics scraping ride this mesh, never the public net.
-rec {
-  hosts = {
-    control = "fd06:1bad:ece2:92ad:ba99:9306:1bad:ece2";
-    ns1 = "fd06:1bad:ece2:92ad:ba99:939d:766d:8974";
-    ns2 = "fd06:1bad:ece2:92ad:ba99:9323:61be:a09e";
-  };
+#
+# Rather than hardcoding the addresses, we read them from the public clan vars
+# that clan-core's zerotier generator already writes per machine
+# (vars/per-machine/<m>/zerotier/zerotier-ip/value). This keeps the mesh map in
+# lockstep with the actual identities: regenerate or re-key a node and its
+# address here follows automatically. Call as: import ../mesh-hosts.nix { inherit config lib; }.
+{ config, lib }:
+let
+  dir = config.clan.core.settings.directory;
 
-  # RFC 4193 /88 prefix of this ZeroTier network (fd + 8-byte network id + the
-  # 0x9993 marker). Covers every mesh peer — servers and admin laptops alike —
+  readVar =
+    machine: file:
+    builtins.readFile "${dir}/vars/per-machine/${machine}/zerotier/${file}/value";
+
+  hosts = lib.genAttrs [ "control" "ns1" "ns2" ] (m: readVar m "zerotier-ip");
+
+  # RFC 4193 prefix of this ZeroTier network: fd + the 8-byte network id + the
+  # 0x9993 marker. The network id is a public var on the controller (control).
+  # The /88 (11 bytes) covers fd + network id + 0x99 + 0x93, i.e. every mesh peer,
   # and is used to scope mesh-only firewall rules.
-  subnet = "fd06:1bad:ece2:92ad:ba99:9300::/88";
+  networkId = readVar "control" "zerotier-network-id";
+  full = "fd" + networkId + "9993"; # 22 hex chars = 11 bytes
+  hextet = i: builtins.substring (i * 4) 4 full;
+  subnet = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
+in
+{
+  inherit hosts subnet;
 }
diff --git a/modules/monitoring/exporters.nix b/modules/monitoring/exporters.nix
index a8a4869..2877923 100644
--- a/modules/monitoring/exporters.nix
+++ b/modules/monitoring/exporters.nix
@@ -9,7 +9,7 @@
   ...
 }:
 let
-  mesh = import ../mesh-hosts.nix;
+  mesh = import ../mesh-hosts.nix { inherit config lib; };
   knotEnabled = config.services.knot.enable;
   # node_exporter on every host; knot-exporter only where Knot runs.
   ports = [ 9100 ] ++ lib.optional knotEnabled 9433;
diff --git a/modules/monitoring/server.nix b/modules/monitoring/server.nix
index 9470b1d..b829d33 100644
--- a/modules/monitoring/server.nix
+++ b/modules/monitoring/server.nix
@@ -9,7 +9,7 @@
   ...
 }:
 let
-  mesh = import ../mesh-hosts.nix;
+  mesh = import ../mesh-hosts.nix { inherit config lib; };
   vmPort = 8428;
   grafanaPort = 3000;
   controlV6 = mesh.hosts.control;