Files

T

Berwn 158252323f Add site gateway role (modules/router) and gw-cnx-1

Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense:
PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl.
username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp,
Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with
the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk.

Fleet baseline rides along: admins sops group is now derived for every
machine in clan.nix (secrets encrypt to it from the first vars generate)
and time sync is chrony everywhere instead of systemd-timesyncd.

2026-07-28 17:06:07 +07:00

1.9 KiB

Raw Blame History

Overview

This is the operational runbook for the cnx-network clan. Everything here is managed declaratively from the clan repo; this book is built from docs/ and served on control over the ZeroTier mesh.

Machines

Machine	Role	Public IPv4	Public IPv6
`control`	ZeroTier controller, monitoring, docs	`77.42.68.181`	`2a01:4f9:c013:e6d0::1`
`ns1`	Knot DNS primary (master)	`46.224.170.206`	`2a01:4f8:c014:b5c5::1`
`ns2`	Knot DNS secondary (slave)	`157.180.70.82`	`2a01:4f9:c014:6d87::1`
`mx1`	Mail server (MX for cnx.email)	`5.223.65.38`	`2a01:4ff:2f0:1963::1`
`web01`	Public reverse proxy (TLS termination)	`5.223.55.246`	`2a01:4ff:2f0:2d8f::1`
`gw-cnx-1`	Site gateway Chiang Mai (router)	dynamic (PPPoE)	—

Access

Admin SSH and all internal services ride the ZeroTier mesh, not the public net. Public SSH (22) is intentionally closed at the Hetzner cloud firewall.
clan reaches machines by their public IPs first (the internet instance), with the mesh and Tor as automatic fallbacks.

Host baseline

Every machine sets a fixed-offset time.timeZone and runs chrony for time sync (services.chrony.enable). chrony is the single NTP implementation across the fleet — do not use systemd-timesyncd; the two are mutually exclusive and we standardise on chrony everywhere. New hosts must set both the timezone and chrony as part of their baseline config.

Editing these docs

Commit-to-edit: change the markdown under docs/src/, commit, and redeploy control. There is no in-browser editor by design — the docs are versioned and reviewed alongside the config that they describe.

1.9 KiB Raw Blame History