Berwn
6e4178df04
- Register mx1 in the inventory and as a direct-SSH `internet` host; give it a static public IPv6 (2a01:4ff:2f0:1963::1). - Point the cnx.email MX (plus SPF/DMARC) at mx1 and add its A record. - Bring mx1 into monitoring: import exporters, add it to the mesh map and the node scrape job so its host metrics and journald reach control. - Add a clan-mx1 Hetzner firewall: inbound SMTP + ZeroTier + ICMP, no public SSH (admin rides the mesh like the other hosts). 587/465/993 held for now. - Extract per-host public IPv4/IPv6 into modules/hosts.nix, consumed by clan.nix's internet hosts and each machine's cnx.staticIPv6, so each address is declared once instead of being duplicated across configs. - docs: add mx1 to the machines table.
32 lines
811 B
Nix
32 lines
811 B
Nix
{ config, ... }:
|
|
let
|
|
domains = import ../../modules/dns/domains.nix;
|
|
hosts = import ../../modules/hosts.nix;
|
|
in
|
|
{
|
|
imports = [
|
|
../../modules/dns/authoritative.nix
|
|
../../modules/static-ipv6.nix
|
|
../../modules/monitoring/exporters.nix
|
|
];
|
|
|
|
clan.core.sops.defaultGroups = [ "admins" ];
|
|
|
|
# Public IPv6 (from modules/hosts.nix; matches the ns2 AAAA glue); SLAAC
|
|
# doesn't bring it up here.
|
|
cnx.staticIPv6 = {
|
|
enable = true;
|
|
address = hosts.${config.networking.hostName}.ipv6;
|
|
};
|
|
|
|
time.timeZone = "Etc/GMT-3"; # UTC+3 (fixed offset, no DST)
|
|
services.timesyncd.enable = true;
|
|
|
|
# ns2 = secondary (slave): pulls every zone from ns1 and accepts its NOTIFY.
|
|
services.knot.settings.zone = map (d: {
|
|
domain = d;
|
|
master = [ "ns1" ];
|
|
acl = [ "acl_ns1" ];
|
|
}) domains;
|
|
}
|