Berwn
158252323f
Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense: PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl. username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp, Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk. Fleet baseline rides along: admins sops group is now derived for every machine in clan.nix (secrets encrypt to it from the first vars generate) and time sync is chrony everywhere instead of systemd-timesyncd.
41 lines
1.7 KiB
Nix
41 lines
1.7 KiB
Nix
# ZeroTier (clan mesh) addresses — the private IPv6 overlay every machine shares.
|
|
# DNS zone transfers and metrics scraping ride this mesh, never the public net.
|
|
#
|
|
# Rather than hardcoding the addresses, we read them from the public clan vars
|
|
# that clan-core's zerotier service writes. As of clan-core 26.05 these are
|
|
# shared, instance-scoped generators: the per-machine IP lives at
|
|
# vars/shared/zerotier-ip-<machine>-<instance>/ip and the network id at
|
|
# vars/shared/zerotier-network-<instance>/network-id (instance = "zerotier",
|
|
# the inventory.instances.zerotier name in clan.nix). This keeps the mesh map in
|
|
# lockstep with the actual identities: regenerate or re-key a node and its
|
|
# address here follows automatically. Call as: import ../mesh-hosts.nix { inherit config lib; }.
|
|
{ config, lib }:
|
|
let
|
|
dir = config.clan.core.settings.directory;
|
|
instance = "zerotier";
|
|
|
|
readIp =
|
|
machine: builtins.readFile "${dir}/vars/shared/zerotier-ip-${machine}-${instance}/ip/value";
|
|
|
|
hosts = lib.genAttrs [
|
|
"control"
|
|
"ns1"
|
|
"ns2"
|
|
"mx1"
|
|
"web01"
|
|
"gw-cnx-1"
|
|
] readIp;
|
|
|
|
# RFC 4193 prefix of this ZeroTier network: fd + the 8-byte network id + the
|
|
# 0x9993 marker. The network id is a public, shared var for the instance.
|
|
# The /88 (11 bytes) covers fd + network id + 0x99 + 0x93, i.e. every mesh peer,
|
|
# and is used to scope mesh-only firewall rules.
|
|
networkId = builtins.readFile "${dir}/vars/shared/zerotier-network-${instance}/network-id/value";
|
|
full = "fd" + networkId + "9993"; # 22 hex chars = 11 bytes
|
|
hextet = i: builtins.substring (i * 4) 4 full;
|
|
subnet = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
|
|
in
|
|
{
|
|
inherit hosts subnet;
|
|
}
|