mxm/homelab
1
0
Fork 0
Code Issues 3 Pull requests Projects Releases Packages Wiki Activity Actions

feat(networking): enroll deployed fleet in ZeroTier mesh #8

Merged
mxm merged 42 commits from feat/zerotier-fleet-mesh into main 2026-07-21 04:21:13 +00:00
Conversation 0 Commits 42 Files changed 84 +646 -109
mxm commented 2026-07-21 04:18:58 +00:00
Owner
Copy link

Summary

  • enroll all 22 deployed Clan-managed NixOS machines in the secondary ZeroTier management mesh
  • preserve Iroh priority, direct SSH, and WireGuard while adding validated LXC TUN strategies
  • harden qBittorrent networking and document the completed fleet rollout and resilience results

Changes

  • derive ZeroTier membership from deployed NixOS inventory state
  • add generated encrypted identities and assigned mesh addresses for 18 new peers
  • validate TUN strategy for 17 LXCs, including privileged NAS cgroup/mknod handling
  • keep container boot activation aligned with the current generation
  • restore qBittorrent private routes after networkd changes and permit ZeroTier through its AirVPN kill switch
  • retire the deferred oi.miskam.xyz tunnel hostname and stale edge route
  • update architecture, runbooks, rollout results, and operator guidance

Test Plan

  • nix fmt -- --fail-on-change
  • git diff --check
  • nix flake check
  • clan vars check for all 22 peers
  • direct SSH, ZeroTier OK PRIVATE, Iroh, system health, and failed-unit checks across all 22 peers
  • all 17 LXCs rebooted into current generations with usable TUN access
  • workstation TCP/22 reached all 22 mesh peers
  • per-host controller/local-router/cross-site sampling and anchor matrix
  • router public-path and controller-loss resilience sample with temporary state removed
  • both edges and critical services verified after deployment
## Summary - enroll all 22 deployed Clan-managed NixOS machines in the secondary ZeroTier management mesh - preserve Iroh priority, direct SSH, and WireGuard while adding validated LXC TUN strategies - harden qBittorrent networking and document the completed fleet rollout and resilience results ## Changes - derive ZeroTier membership from deployed NixOS inventory state - add generated encrypted identities and assigned mesh addresses for 18 new peers - validate TUN strategy for 17 LXCs, including privileged NAS cgroup/mknod handling - keep container boot activation aligned with the current generation - restore qBittorrent private routes after networkd changes and permit ZeroTier through its AirVPN kill switch - retire the deferred `oi.miskam.xyz` tunnel hostname and stale edge route - update architecture, runbooks, rollout results, and operator guidance ## Test Plan - [x] `nix fmt -- --fail-on-change` - [x] `git diff --check` - [x] `nix flake check` - [x] `clan vars check` for all 22 peers - [x] direct SSH, ZeroTier `OK PRIVATE`, Iroh, system health, and failed-unit checks across all 22 peers - [x] all 17 LXCs rebooted into current generations with usable TUN access - [x] workstation TCP/22 reached all 22 mesh peers - [x] per-host controller/local-router/cross-site sampling and anchor matrix - [x] router public-path and controller-loss resilience sample with temporary state removed - [x] both edges and critical services verified after deployment
mxm added 109 commits 2026-07-21 04:18:58 +00:00
docs: record Clan mesh rollout state
Some checks failed
CI / flake-check (push) Has been cancelled
Details
a9f31676e0
docs: close out ZeroTier fleet rollout
Some checks failed
CI / flake-check (pull_request) Failing after 16m5s
Details
11112afc32
mxm merged commit 9f029e2226 into main 2026-07-21 04:21:13 +00:00
mxm deleted branch feat/zerotier-fleet-mesh 2026-07-21 04:21:13 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
mxm/homelab!8
No description provided.