Berwn
6e4178df04
- Register mx1 in the inventory and as a direct-SSH `internet` host; give it a static public IPv6 (2a01:4ff:2f0:1963::1). - Point the cnx.email MX (plus SPF/DMARC) at mx1 and add its A record. - Bring mx1 into monitoring: import exporters, add it to the mesh map and the node scrape job so its host metrics and journald reach control. - Add a clan-mx1 Hetzner firewall: inbound SMTP + ZeroTier + ICMP, no public SSH (admin rides the mesh like the other hosts). 587/465/993 held for now. - Extract per-host public IPv4/IPv6 into modules/hosts.nix, consumed by clan.nix's internet hosts and each machine's cnx.staticIPv6, so each address is declared once instead of being duplicated across configs. - docs: add mx1 to the machines table.
31 lines
1.4 KiB
Nix
31 lines
1.4 KiB
Nix
# ZeroTier (clan mesh) addresses — the private IPv6 overlay every machine shares.
|
|
# DNS zone transfers and metrics scraping ride this mesh, never the public net.
|
|
#
|
|
# Rather than hardcoding the addresses, we read them from the public clan vars
|
|
# that clan-core's zerotier generator already writes per machine
|
|
# (vars/per-machine/<m>/zerotier/zerotier-ip/value). This keeps the mesh map in
|
|
# lockstep with the actual identities: regenerate or re-key a node and its
|
|
# address here follows automatically. Call as: import ../mesh-hosts.nix { inherit config lib; }.
|
|
{ config, lib }:
|
|
let
|
|
dir = config.clan.core.settings.directory;
|
|
|
|
readVar =
|
|
machine: file:
|
|
builtins.readFile "${dir}/vars/per-machine/${machine}/zerotier/${file}/value";
|
|
|
|
hosts = lib.genAttrs [ "control" "ns1" "ns2" "mx1" ] (m: readVar m "zerotier-ip");
|
|
|
|
# RFC 4193 prefix of this ZeroTier network: fd + the 8-byte network id + the
|
|
# 0x9993 marker. The network id is a public var on the controller (control).
|
|
# The /88 (11 bytes) covers fd + network id + 0x99 + 0x93, i.e. every mesh peer,
|
|
# and is used to scope mesh-only firewall rules.
|
|
networkId = readVar "control" "zerotier-network-id";
|
|
full = "fd" + networkId + "9993"; # 22 hex chars = 11 bytes
|
|
hextet = i: builtins.substring (i * 4) 4 full;
|
|
subnet = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
|
|
in
|
|
{
|
|
inherit hosts subnet;
|
|
}
|