Berwn
33ac7e106b
control runs VictoriaMetrics (loopback) and Grafana; every machine exports node metrics and the nameservers export Knot stats (mod-stats + knot-exporter). Scraping and the Grafana UI ride the ZeroTier mesh only, scoped by nftables to the mesh /88; the public side stays closed by the Hetzner cloud firewall. The provisioned DNS dashboard includes a per-zone SOA serial table to catch primary/secondary drift. ZeroTier ULAs are centralised in mesh-hosts.nix.
30 lines
716 B
Nix
30 lines
716 B
Nix
{ ... }:
|
|
let
|
|
domains = import ../../modules/dns/domains.nix;
|
|
in
|
|
{
|
|
imports = [
|
|
../../modules/dns/authoritative.nix
|
|
../../modules/static-ipv6.nix
|
|
../../modules/monitoring/exporters.nix
|
|
];
|
|
|
|
clan.core.sops.defaultGroups = [ "admins" ];
|
|
|
|
# Public IPv6 (matches the ns2 AAAA glue); SLAAC doesn't bring it up here.
|
|
cnx.staticIPv6 = {
|
|
enable = true;
|
|
address = "2a01:4f9:c014:6d87::1";
|
|
};
|
|
|
|
time.timeZone = "Etc/GMT-3"; # UTC+3 (fixed offset, no DST)
|
|
services.timesyncd.enable = true;
|
|
|
|
# ns2 = secondary (slave): pulls every zone from ns1 and accepts its NOTIFY.
|
|
services.knot.settings.zone = map (d: {
|
|
domain = d;
|
|
master = [ "ns1" ];
|
|
acl = [ "acl_ns1" ];
|
|
}) domains;
|
|
}
|