+5 -13

CLAUDE.md

View file Reviewed

··· 25 25 - **Tor**: Anonymous network access 26 26 27 27 ### Module System 28 28 - - `2configs/`: Main configuration modules (imported by all machines) 28 28 + - `2configs/`: Main configuration modules 29 29 + - `2configs/default.nix`: imported by all machines 29 30 - `3modules/`: Custom NixOS module definitions 30 31 - Stockholm modules are also imported for krebs infrastructure 31 32 ··· 35 36 # Enter development shell 36 37 nix develop 37 38 38 38 - # Run interactive menu (default package) 39 39 - nix run 40 40 - 41 39 # Deploy to a specific machine 42 42 - nix run .#deploy -- <MACHINE_NAME> 40 40 + clan machines update <MACHINE_NAME> 43 41 44 42 # Format code 45 43 nix fmt ··· 64 62 65 63 **CRITICAL**: New nix files must be staged (git add) before they are available in flake evaluation. When creating new packages, modules, or any nix files, always run `git add <files>` before testing with `nix build`, `nix run`, etc. 66 64 67 67 - ## Machine Facts and Secrets 65 65 + ## Machine Facts and Secrets via vars 68 66 69 69 - Each machine stores its public facts in `machines/<name>/facts/` including: 70 67 - SSH public keys 71 68 - Network identities (retiolum, mycelium, zerotier) 72 69 - Syncthing IDs 73 70 - DKIM keys (for mail servers) 74 71 75 75 - Secrets are managed via password-store and uploaded to `/etc/secrets` on deployment. 72 72 + Secrets are managed via password-store and uploaded to `/run/secrets` on deployment. 76 73 77 74 ## Adding New Machines 78 75 ··· 81 78 3. Generate facts using clan-cli 82 79 4. Add to inventory in `flake.nix` 83 80 5. Deploy using `nix run .#deploy -- <name>` 84 84 - 85 85 - ## Testing 86 86 - 87 87 - - VM tests: `./5pkgs/init/test.sh` 88 88 - - Container tests are configured in `2configs/container-tests.nix` 89 81 90 82 ## Commit Message Guidelines 91 83

-34

test.md

Reviewed

··· 1 1 - 2 2 - ## Overview 3 3 - 4 4 - This guide explains how to set up and manage a [ZeroTier VPN](https://zerotier.com) for a clan network. Each VPN requires a single controller and can support multiple peers and optional moons for better connectivity. 5 5 - 6 6 - ## Roles 7 7 - 8 8 - ### 1. Controller 9 9 - 10 10 - The [Controller](https://docs.zerotier.com/controller/) manages network membership and is responsible for admitting new peers. 11 11 - When a new node is added to the clan, the controller must be updated to ensure it has the latest member list. 12 12 - 13 13 - - **Key Points:** 14 14 - - Must be online to admit new machines to the VPN. 15 15 - - Existing nodes can continue to communicate even when the controller is offline. 16 16 - 17 17 - ### 2. Moons 18 18 - 19 19 - [Moons](https://docs.zerotier.com/roots) act as relay nodes, 20 20 - providing direct connectivity to peers via their public IP addresses. 21 21 - They enable devices that are not publicly reachable to join the VPN by routing through these nodes. 22 22 - 23 23 - - **Configuration Notes:** 24 24 - - Each moon must define its public IP address. 25 25 - - Ensures connectivity for devices behind NAT or restrictive firewalls. 26 26 - 27 27 - ### 3. Peers 28 28 - 29 29 - Peers are standard nodes in the VPN. 30 30 - They connect to other peers, moons, and the controller as needed. 31 31 - 32 32 - - **Purpose:** 33 33 - - General role for all machines that are neither controllers nor moons. 34 34 - - Ideal for most clan members' devices.