Berwn
33ac7e106b
control runs VictoriaMetrics (loopback) and Grafana; every machine exports node metrics and the nameservers export Knot stats (mod-stats + knot-exporter). Scraping and the Grafana UI ride the ZeroTier mesh only, scoped by nftables to the mesh /88; the public side stays closed by the Hetzner cloud firewall. The provisioned DNS dashboard includes a per-zone SOA serial table to catch primary/secondary drift. ZeroTier ULAs are centralised in mesh-hosts.nix.
27 lines
734 B
Nix
27 lines
734 B
Nix
{
|
|
imports = [
|
|
../../modules/hetzner-firewall.nix
|
|
../../modules/static-ipv6.nix
|
|
../../modules/monitoring/exporters.nix
|
|
../../modules/monitoring/server.nix
|
|
];
|
|
|
|
clan.core.sops.defaultGroups = [ "admins" ];
|
|
|
|
# Public IPv6; SLAAC doesn't bring it up here.
|
|
cnx.staticIPv6 = {
|
|
enable = true;
|
|
address = "2a01:4f9:c013:e6d0::1";
|
|
};
|
|
|
|
time.timeZone = "Etc/GMT-3"; # UTC+3 (fixed offset, no DST)
|
|
services.timesyncd.enable = true;
|
|
|
|
# Public Hetzner Cloud firewalls, synced from this config on every deploy.
|
|
# Rules live in their own data file; see that file for the no-public-SSH note.
|
|
cnx.hetznerFirewall = {
|
|
enable = true;
|
|
firewalls = import ../../modules/hetzner-firewall-rules.nix;
|
|
};
|
|
}
|