From 74699767504b50a05953d490e9632ced5ff6599a Mon Sep 17 00:00:00 2001 From: kurogeek Date: Fri, 2 Oct 2026 07:53:47 +0000 Subject: [PATCH] stellio: allow ssh over yggdrasil The router service only opens SSH to the mgmt VLAN, the staging port and the ZeroTier mesh. Also admit it on the yggdrasil interface (`ygg`, as named by clan-core's service) so the box stays reachable when ZeroTier is down. Interface-scoped, so a spoofed 200::/7 source on the WAN never matches. --- machines/stellio/configuration.nix | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/machines/stellio/configuration.nix b/machines/stellio/configuration.nix index 95c5217d..0eb54e06 100644 --- a/machines/stellio/configuration.nix +++ b/machines/stellio/configuration.nix @@ -83,6 +83,17 @@ '') ]; + # The router service opens SSH only to the mgmt VLAN, the staging port + # and the ZeroTier mesh (inventories/router.nix). Also admit it over + # Yggdrasil (fleet-wide instance in inventories/default.nix) so the box + # stays reachable when ZeroTier's controller/relays are down. Scoped to + # the tunnel interface (clan-core's yggdrasil service names it `ygg`): + # only decrypted 200::/7 traffic arrives there, so a spoofed source on + # the WAN never matches. + networking.firewall.interfaces.${config.services.yggdrasil.settings.IfName}.allowedTCPPorts = [ + 22 + ]; + systemd.services.heartbeat-push = { description = "Heartbeat push to uptime monitor"; serviceConfig = {