Berwn
6e4178df04
- Register mx1 in the inventory and as a direct-SSH `internet` host; give it a static public IPv6 (2a01:4ff:2f0:1963::1). - Point the cnx.email MX (plus SPF/DMARC) at mx1 and add its A record. - Bring mx1 into monitoring: import exporters, add it to the mesh map and the node scrape job so its host metrics and journald reach control. - Add a clan-mx1 Hetzner firewall: inbound SMTP + ZeroTier + ICMP, no public SSH (admin rides the mesh like the other hosts). 587/465/993 held for now. - Extract per-host public IPv4/IPv6 into modules/hosts.nix, consumed by clan.nix's internet hosts and each machine's cnx.staticIPv6, so each address is declared once instead of being duplicated across configs. - docs: add mx1 to the machines table.
19 lines
572 B
Dns
19 lines
572 B
Dns
$ORIGIN cnx.email.
|
|
$TTL 3600
|
|
|
|
@ IN SOA ns1.cnx.network. hostmaster.cnx.network. (
|
|
2026061401 ; serial (ignored: Knot auto-assigns a dateserial on signing)
|
|
3600 ; refresh
|
|
900 ; retry
|
|
604800 ; expire
|
|
300 ) ; negative-cache TTL
|
|
|
|
@ IN NS ns1.cnx.network.
|
|
@ IN NS ns2.cnx.network.
|
|
|
|
; ---- Mail ----
|
|
mx1 IN A 5.223.65.38
|
|
@ IN MX 10 mx1.cnx.email.
|
|
@ IN TXT "v=spf1 mx -all"
|
|
_dmarc IN TXT "v=DMARC1; p=quarantine; rua=mailto:postmaster@cnx.email"
|