Berwn
6e4178df04
- Register mx1 in the inventory and as a direct-SSH `internet` host; give it a static public IPv6 (2a01:4ff:2f0:1963::1). - Point the cnx.email MX (plus SPF/DMARC) at mx1 and add its A record. - Bring mx1 into monitoring: import exporters, add it to the mesh map and the node scrape job so its host metrics and journald reach control. - Add a clan-mx1 Hetzner firewall: inbound SMTP + ZeroTier + ICMP, no public SSH (admin rides the mesh like the other hosts). 587/465/993 held for now. - Extract per-host public IPv4/IPv6 into modules/hosts.nix, consumed by clan.nix's internet hosts and each machine's cnx.staticIPv6, so each address is declared once instead of being duplicated across configs. - docs: add mx1 to the machines table.
70 lines
1.4 KiB
Nix
70 lines
1.4 KiB
Nix
# Hetzner Cloud firewall rules, keyed by firewall name. Imported by
|
|
# machines/control/configuration.nix and fed to cnx.hetznerFirewall.firewalls.
|
|
#
|
|
# Public SSH (22) is intentionally absent: admin access rides the ZeroTier mesh
|
|
# (inside UDP 9993), with emergency-access as the console fallback.
|
|
let
|
|
world = [
|
|
"0.0.0.0/0"
|
|
"::/0"
|
|
];
|
|
|
|
zerotier = {
|
|
direction = "in";
|
|
protocol = "udp";
|
|
port = "9993";
|
|
source_ips = world;
|
|
description = "ZeroTier";
|
|
};
|
|
|
|
ping = {
|
|
direction = "in";
|
|
protocol = "icmp";
|
|
source_ips = world;
|
|
description = "ICMP (ping / PMTUD)";
|
|
};
|
|
|
|
# Inbound mail only. mx1 is the MX for cnx.email, so other servers deliver on
|
|
# 25. Submission (587/465) and IMAP (993) stay closed until the mail stack and
|
|
# mailboxes exist — admin access rides the mesh, same as the other hosts.
|
|
smtp = {
|
|
direction = "in";
|
|
protocol = "tcp";
|
|
port = "25";
|
|
source_ips = world;
|
|
description = "SMTP (inbound mail)";
|
|
};
|
|
|
|
dnsRules = [
|
|
{
|
|
direction = "in";
|
|
protocol = "udp";
|
|
port = "53";
|
|
source_ips = world;
|
|
description = "DNS (UDP)";
|
|
}
|
|
{
|
|
direction = "in";
|
|
protocol = "tcp";
|
|
port = "53";
|
|
source_ips = world;
|
|
description = "DNS (TCP)";
|
|
}
|
|
zerotier
|
|
ping
|
|
];
|
|
in
|
|
{
|
|
"clan-control" = [
|
|
zerotier
|
|
ping
|
|
];
|
|
"clan-ns1" = dnsRules;
|
|
"clan-ns2" = dnsRules;
|
|
"clan-mx1" = [
|
|
smtp
|
|
zerotier
|
|
ping
|
|
];
|
|
}
|