# ZeroTier (clan mesh) addresses — the private IPv6 overlay every machine shares.
# DNS zone transfers and metrics scraping ride this mesh, never the public net.
#
# Rather than hardcoding the addresses, we read them from the public clan vars
# that clan-core's zerotier generator already writes per machine
# (vars/per-machine/<m>/zerotier/zerotier-ip/value). This keeps the mesh map in
# lockstep with the actual identities: regenerate or re-key a node and its
# address here follows automatically. Call as: import ../mesh-hosts.nix { inherit config lib; }.
{ config, lib }:
let
  dir = config.clan.core.settings.directory;

  readVar =
    machine: file: builtins.readFile "${dir}/vars/per-machine/${machine}/zerotier/${file}/value";

  hosts = lib.genAttrs [
    "control"
    "ns1"
    "ns2"
    "mx1"
    "web01"
  ] (m: readVar m "zerotier-ip");

  # RFC 4193 prefix of this ZeroTier network: fd + the 8-byte network id + the
  # 0x9993 marker. The network id is a public var on the controller (control).
  # The /88 (11 bytes) covers fd + network id + 0x99 + 0x93, i.e. every mesh peer,
  # and is used to scope mesh-only firewall rules.
  networkId = readVar "control" "zerotier-network-id";
  full = "fd" + networkId + "9993"; # 22 hex chars = 11 bytes
  hextet = i: builtins.substring (i * 4) 4 full;
  subnet = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
in
{
  inherit hosts subnet;
}