diff --git a/flake.nix b/flake.nix
index cd6a11f..6acd2d1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -19,6 +19,7 @@
         inputs.nix-topology.flakeModule
 
         ./devShells/flake-module.nix
+        ./machines/flake-module.nix
       ];
 
       systems = [
@@ -26,49 +27,6 @@
         "aarch64-linux"
       ];
 
-      clan = {
-        meta.name = "blossom";
-
-        inventory = {
-          instances = {
-            "rpqt-admin" = {
-              module.input = "clan-core";
-              module.name = "admin";
-              roles.default.machines = {
-                "crocus" = { };
-                "genepi" = { };
-                "haze" = { };
-              };
-              roles.default.settings.allowedKeys = {
-                rpqt_haze = (import ./parts).keys.rpqt.haze;
-              };
-            };
-          };
-          services = {
-            zerotier.default = {
-              roles.controller.machines = [
-                "crocus"
-              ];
-              roles.peer.machines = [
-                "haze"
-                "genepi"
-              ];
-            };
-            sshd.default = {
-              roles.server.machines = [ "crocus" ];
-            };
-            user-password.rpqt = {
-              roles.default.machines = [
-                "crocus"
-                "genepi"
-                "haze"
-              ];
-              config.user = "rpqt";
-            };
-          };
-        };
-      };
-
       perSystem = _: {
         topology.modules = [
           ./topology.nix
diff --git a/machines/flake-module.nix b/machines/flake-module.nix
new file mode 100644
index 0000000..324f9ed
--- /dev/null
+++ b/machines/flake-module.nix
@@ -0,0 +1,50 @@
+{
+
+  clan = {
+    meta.name = "blossom";
+
+    inventory.instances = {
+      "rpqt-admin" = {
+        module.input = "clan-core";
+        module.name = "admin";
+        roles.default.machines = {
+          "crocus" = { };
+          "genepi" = { };
+          "haze" = { };
+        };
+        roles.default.settings.allowedKeys = {
+          rpqt_haze = (import ../parts).keys.rpqt.haze;
+        };
+      };
+
+      "rpqt-zerotier" = {
+        module.input = "clan-core";
+        module.name = "zerotier";
+        roles.controller.machines.crocus = { };
+        roles.moon.machines.crocus = {
+          settings = {
+            stableEndpoints = [
+              "167.235.28.141"
+              "2a01:4f8:1c1e:e415::/64"
+            ];
+          };
+        };
+        roles.peer.tags."all" = { };
+      };
+    };
+
+    inventory.services = {
+      sshd.default = {
+        roles.server.tags = [ "all" ];
+      };
+      user-password.rpqt = {
+        roles.default.machines = [
+          "crocus"
+          "genepi"
+          "haze"
+        ];
+        config.user = "rpqt";
+      };
+    };
+  };
+}