Berwn
48fcc3058b
Bump clan-core and nixos-mailserver to 26.05 (NixOS 26.05) and adapt to
the breaking changes surfaced by nix flake check:
- mesh-hosts/clan.nix: read the new shared, instance-scoped zerotier vars
(zerotier-ip-<machine>-zerotier, zerotier-network-zerotier); admit
external members via the controller's native allowedIds.
- monitoring/server.nix: Grafana lost its built-in secret_key default;
mint one via a clan generator and pass it with $__file{}.
- dns/authoritative.nix: services.resolved.extraConfig removed -> settings.
- mail.nix: SNM cert API change (x509.useACMEHost + acme extraDomainNames)
and accounts/dkim option renames.
- docs: mesh runbook updated for the new var paths and allowedIds.
1.5 KiB
ZeroTier mesh
A private IPv6 overlay that every machine (and admin laptops) shares. DNS zone transfers and metrics scraping ride this mesh, never the public net.
- Controller:
control(thezerotierinstance inclan.nix). - Peers: every machine (
roles.peer.tags.all). - Prefix:
fd06:1bad:ece2:92ad:ba99:9300::/88(RFC 4193:fd+ network id +0x9993).
The mesh map
modules/mesh-hosts.nix does not hardcode addresses. It reads each machine's
IP from the public clan vars that clan-core's zerotier service writes. As of
clan-core 26.05 these are shared, instance-scoped generators
(vars/shared/zerotier-ip-<machine>-zerotier/ip/value), and the /88 subnet is
derived from the instance network id
(vars/shared/zerotier-network-zerotier/network-id/value). Regenerate or re-key a
node and the map follows automatically.
Consumers: modules/dns/authoritative.nix (transfer ACLs), modules/monitoring/*
(scrape targets and firewall scoping).
Admitting external members
Inventory machines are auto-accepted. External devices (admin laptops) are listed
in clan.nix under the controller's allowedIds — clan-core 26.05 admits members
by their 10-char ZeroTier node id directly, so no IP derivation is needed:
roles.controller.settings.allowedIds = [
"8802c8d7e0" # alex-nixos
"2bd36db8cc" # kurogeek-thinkpad
];
A device's 10-char node id comes from zerotier-cli info on that device. After
editing, deploy control; the controller admits the new member on its next run.