# ZeroTier mesh

A private IPv6 overlay that every machine (and admin laptops) shares. DNS zone
transfers and metrics scraping ride this mesh, never the public net.

- **Controller:** `control` (the `zerotier` instance in `clan.nix`).
- **Peers:** every machine (`roles.peer.tags.all`).
- **Prefix:** `fd06:1bad:ece2:92ad:ba99:9300::/88` (RFC 4193: `fd` + network id + `0x9993`).

## The mesh map

`modules/mesh-hosts.nix` does **not** hardcode addresses. It reads each machine's
IP from the public clan vars that clan-core's zerotier service writes. As of
clan-core 26.05 these are shared, instance-scoped generators
(`vars/shared/zerotier-ip-<machine>-zerotier/ip/value`), and the `/88` subnet is
derived from the instance network id
(`vars/shared/zerotier-network-zerotier/network-id/value`). Regenerate or re-key a
node and the map follows automatically.

Consumers: `modules/dns/authoritative.nix` (transfer ACLs), `modules/monitoring/*`
(scrape targets and firewall scoping).

## Admitting external members

Inventory machines are auto-accepted. External devices (admin laptops) are listed
in `clan.nix` under the controller's `allowedIds` — clan-core 26.05 admits members
by their 10-char ZeroTier node id directly, so no IP derivation is needed:

```nix
roles.controller.settings.allowedIds = [
  "8802c8d7e0" # alex-nixos
  "2bd36db8cc" # kurogeek-thinkpad
];
```

A device's 10-char node id comes from `zerotier-cli info` on that device. After
editing, deploy `control`; the controller admits the new member on its next run.