Berwn
72 lines
2.3 KiB
Nix
72 lines
2.3 KiB
Nix
let
|
|
# This clan-core pins the zerotier `allowedIps` interface (admit by network
|
|
# IPv6), but node IDs are the stable per-device handle (what `zerotier-cli
|
|
# info` prints). Derive a member's IP on THIS network from the controller's
|
|
# network id so external members can be listed by node id, as below.
|
|
ztNetworkId = builtins.readFile ./vars/per-machine/control/zerotier/zerotier-network-id/value;
|
|
ztMemberIp =
|
|
nodeId:
|
|
let
|
|
full = "fd" + ztNetworkId + "9993" + nodeId;
|
|
h = i: builtins.substring (i * 4) 4 full;
|
|
in
|
|
"${h 0}:${h 1}:${h 2}:${h 3}:${h 4}:${h 5}:${h 6}:${h 7}";
|
|
in
|
|
{
|
|
# Ensure this is unique among all clans you want to use.
|
|
meta.name = "cnx-network-clan";
|
|
meta.domain = "cnx-network.internal";
|
|
|
|
inventory.machines = {
|
|
control = { };
|
|
ns1 = { };
|
|
ns2 = { };
|
|
};
|
|
|
|
inventory.instances = {
|
|
|
|
admin = {
|
|
roles.default.tags.all = { };
|
|
roles.default.settings.allowedKeys = {
|
|
"berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENAjhGQGraQoAjJzsomKP8GAmQPeGL1rNRNHgRcLqtT";
|
|
"kurogeek" =
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
|
|
};
|
|
};
|
|
|
|
zerotier = {
|
|
roles.controller.machines."control" = { };
|
|
roles.peer.tags.all = { };
|
|
# External members admitted by ZeroTier node id (stable per device).
|
|
# Inventory machines are auto-accepted; this is only for peers outside the
|
|
# clan. Node id comes from `zerotier-cli info` on the joining device.
|
|
roles.controller.settings.allowedIps = map ztMemberIp [
|
|
"8802c8d7e0" # alex-nixos
|
|
"2bd36db8cc" # kurogeek-thinkpad
|
|
];
|
|
};
|
|
|
|
tor = {
|
|
roles.server.tags.nixos = { };
|
|
};
|
|
|
|
# Direct SSH to public IPs — clan's priority-1 connection path, with the
|
|
# ZeroTier mesh and Tor kept as automatic fallbacks. Raw IPs (not the
|
|
# ns1/ns2 DNS names) so reaching these hosts never depends on their own
|
|
# DNS being up.
|
|
internet = {
|
|
roles.default.machines.control.settings.host = "77.42.68.181";
|
|
roles.default.machines.ns1.settings.host = "46.224.170.206";
|
|
roles.default.machines.ns2.settings.host = "157.180.70.82";
|
|
};
|
|
|
|
# Recovery root password for console access when a machine fails to boot.
|
|
emergency-access = {
|
|
roles.default.tags.nixos = { };
|
|
};
|
|
};
|
|
|
|
machines = {
|
|
};
|
|
}
|