Berwn
6e4178df04
- Register mx1 in the inventory and as a direct-SSH `internet` host; give it a static public IPv6 (2a01:4ff:2f0:1963::1). - Point the cnx.email MX (plus SPF/DMARC) at mx1 and add its A record. - Bring mx1 into monitoring: import exporters, add it to the mesh map and the node scrape job so its host metrics and journald reach control. - Add a clan-mx1 Hetzner firewall: inbound SMTP + ZeroTier + ICMP, no public SSH (admin rides the mesh like the other hosts). 587/465/993 held for now. - Extract per-host public IPv4/IPv6 into modules/hosts.nix, consumed by clan.nix's internet hosts and each machine's cnx.staticIPv6, so each address is declared once instead of being duplicated across configs. - docs: add mx1 to the machines table.
29 lines
936 B
Nix
29 lines
936 B
Nix
# Per-host public network facts: single source of truth for each machine's
|
|
# public IPv4 and its static public IPv6. Consumed by clan.nix's `internet`
|
|
# connection hosts (ipv4) and each machine's `cnx.staticIPv6` (ipv6), so an
|
|
# address is written once instead of being duplicated across configs.
|
|
#
|
|
# NOT a driver for the DNS zone files — those stay hand-edited text, so a record
|
|
# here that also appears as A/AAAA glue still needs a matching manual zone edit.
|
|
#
|
|
# ipv6 is the single address to assign from the host's allocated /64 (we take
|
|
# ::1), without prefix length; cnx.staticIPv6 supplies the /64 default.
|
|
{
|
|
control = {
|
|
ipv4 = "77.42.68.181";
|
|
ipv6 = "2a01:4f9:c013:e6d0::1";
|
|
};
|
|
ns1 = {
|
|
ipv4 = "46.224.170.206";
|
|
ipv6 = "2a01:4f8:c014:b5c5::1";
|
|
};
|
|
ns2 = {
|
|
ipv4 = "157.180.70.82";
|
|
ipv6 = "2a01:4f9:c014:6d87::1";
|
|
};
|
|
mx1 = {
|
|
ipv4 = "5.223.65.38";
|
|
ipv6 = "2a01:4ff:2f0:1963::1";
|
|
};
|
|
}
|