Berwn
dc21348727
Pure formatting (nixfmt/prettier/yamlfmt); no behavior change. These files predate the current treefmt config and were failing nix flake check; reformatting them makes the gate green again.
30 lines
1.4 KiB
Nix
30 lines
1.4 KiB
Nix
# ZeroTier (clan mesh) addresses — the private IPv6 overlay every machine shares.
|
|
# DNS zone transfers and metrics scraping ride this mesh, never the public net.
|
|
#
|
|
# Rather than hardcoding the addresses, we read them from the public clan vars
|
|
# that clan-core's zerotier generator already writes per machine
|
|
# (vars/per-machine/<m>/zerotier/zerotier-ip/value). This keeps the mesh map in
|
|
# lockstep with the actual identities: regenerate or re-key a node and its
|
|
# address here follows automatically. Call as: import ../mesh-hosts.nix { inherit config lib; }.
|
|
{ config, lib }:
|
|
let
|
|
dir = config.clan.core.settings.directory;
|
|
|
|
readVar =
|
|
machine: file: builtins.readFile "${dir}/vars/per-machine/${machine}/zerotier/${file}/value";
|
|
|
|
hosts = lib.genAttrs [ "control" "ns1" "ns2" "mx1" ] (m: readVar m "zerotier-ip");
|
|
|
|
# RFC 4193 prefix of this ZeroTier network: fd + the 8-byte network id + the
|
|
# 0x9993 marker. The network id is a public var on the controller (control).
|
|
# The /88 (11 bytes) covers fd + network id + 0x99 + 0x93, i.e. every mesh peer,
|
|
# and is used to scope mesh-only firewall rules.
|
|
networkId = readVar "control" "zerotier-network-id";
|
|
full = "fd" + networkId + "9993"; # 22 hex chars = 11 bytes
|
|
hextet = i: builtins.substring (i * 4) 4 full;
|
|
subnet = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
|
|
in
|
|
{
|
|
inherit hosts subnet;
|
|
}
|