diff --git a/containers/107-dns.md b/containers/107-dns.md new file mode 100644 index 0000000..2dbee90 --- /dev/null +++ b/containers/107-dns.md @@ -0,0 +1,39 @@ +# 107 — `dns` + +Homelab DNS server (Technitium). Replaces the dnsmasq that lived on [124 — authentik](124-authentik.md); single-purpose, one job. + +## At a glance +- **Hostname:** `dns` +- **IP:** `192.168.8.2` (static — stable, decoupled from any app) +- **Privilege:** privileged (Docker-in-LXC, `features: nesting=1`) +- **Resources:** 1 core / 1 GiB / 8 GiB rootfs +- **Created:** 2026-06-01, Debian 13. Its own resolver is `1.1.1.1` (no circular dependency on the DNS it serves). + +## Role +Authoritative split-horizon DNS for `hubris.network` on the LAN/mesh, plus recursive forwarding (`1.1.1.1`, `8.8.8.8`) for everything else. Technitium runs in Docker (`technitium/dns-server:latest`, `network_mode: host`), web console on `:5380`. + +## The `hubris.network` zone +- Specific A overrides: app names → `192.168.8.175` (Caddy), `nfs-export → 192.168.8.200`, `auth/sso/...` as needed. +- `auth.hubris.network → 82.165.190.79` (VPS Authentik), `sso.hubris.network → 192.168.8.175` (LAN forward-auth outpost). +- **Wildcard** `*.hubris.network → 82.165.190.79` — mirrors the public IONOS wildcard so undefined names (e.g. `netbird`) resolve to the VPS, matching public behaviour. +- **MX / SPF-TXT / CAA replicated from public** so an authoritative zone doesn't shadow `hubris.network` email/cert records. + +## Config / access +- `/opt/technitium/docker-compose.yml`; admin password in `/opt/technitium/admin_password.txt` (mode 600 — sops-encrypt in Phase 5). +- Console: `http://192.168.8.2:5380` (user `admin`). +- API: `http://192.168.8.2:5380/api/...` (token via `/api/user/login`). Zone was built via the API. + +## Who points here +- **NetBird mesh peers:** nameserver group `home-lab-dns` (`hubris.network` → this server). *Note: the [NetBird managed DNS zone](124-authentik.md) still answers most app names directly, bypassing this — see the single-source-of-truth decision.* +- **Plain LAN clients:** router DHCP should hand out `192.168.8.2` (update the router — the old `.180`/dnsmasq is gone). +- **Secondary:** Mac Mini (planned, Phase 3) via AXFR zone transfer. + +## Related +- [124 — authentik](124-authentik.md) — retired host of the old dnsmasq +- [DNS split-horizon](../infrastructure/dns.md) +- [Mesh](../infrastructure/mesh.md) + +## Changelog + +### 2026-06-01 — created; replaced dnsmasq on 124 +Stood up Technitium at `192.168.8.2`, imported the split-horizon zone (specific A + wildcard + MX/SPF/CAA), made it the primary nameserver in the NetBird `home-lab-dns` group. Verified all names resolve with dnsmasq/124 stopped; [LXC 124 retired](124-authentik.md). diff --git a/containers/124-authentik.md b/containers/124-authentik.md index e597432..5a1af7f 100644 --- a/containers/124-authentik.md +++ b/containers/124-authentik.md @@ -172,6 +172,9 @@ dnsmasq runs alongside Authentik on this LXC, listening on `192.168.8.180:53` + ## Changelog +### 2026-06-01 — RETIRED (shut down) +dnsmasq relocated to [dns (107)](107-dns.md) Technitium at `192.168.8.2`. With both its services gone (Authentik → VPS, dnsmasq → 107), LXC 124 was verified idle and **shut down** (`pct stop`). Kept (not destroyed) with the `pre-arch-migration` snapshot for ≥30-day rollback, then `pct destroy`. + ### 2026-06-01 — forward-auth outpost cut over to LXC 106; Authentik stopped on 124 The embedded outpost that Caddy called at `192.168.8.180:9000` was replaced by a dedicated LAN outpost on [106 — auth-outpost](106-auth-outpost.md) (`192.168.8.6:9000`), connected to the VPS core. Authentik (`server/worker/postgresql`) was **stopped** on this LXC; forward-auth apps verified working without it. **dnsmasq still runs here** — 124 stays up as a DNS-only box until DNS is relocated (architecture-migration Phase 2). Once DNS moves, 124 can be fully retired. diff --git a/infrastructure/dns.md b/infrastructure/dns.md index 4e168fb..fd58042 100644 --- a/infrastructure/dns.md +++ b/infrastructure/dns.md @@ -80,6 +80,9 @@ Either: ## Changelog +### 2026-06-01 — dnsmasq replaced by Technitium on [dns (107)](../containers/107-dns.md); LXC 124 retired +Split-horizon DNS moved off [124](../containers/124-authentik.md) to a dedicated **Technitium** LXC at **`192.168.8.2`** (zone: specific A overrides + wildcard→VPS + replicated MX/SPF/CAA). NetBird `home-lab-dns` nameserver group cut over to `192.168.8.2` (with `.180` as a now-dead fallback). dnsmasq stopped, all names verified via Technitium, **LXC 124 shut down**. **Caveat:** the [NetBird managed DNS zone](../containers/124-authentik.md) still answers most app names *directly* (bypassing the nameserver group) — three overlapping DNS sources remain; see the single-source-of-truth decision (Phase 4). **Action needed:** update router DHCP DNS from the dead `.180` → `192.168.8.2` for any plain-LAN (non-mesh) clients. + ### 2026-05-31 — `auth.hubris.network` re-pointed to the VPS (`82.165.190.79`) Authentik migrated off LXC 124 onto the VPS (see [investigation](../investigations/2026-05-31-authentik-vps-migration.md)). The dnsmasq entry changed from `192.168.8.175` (home Caddy) to `82.165.190.79` (VPS traefik). This is the first LAN entry that intentionally points at the VPS rather than Caddy — `auth` is now a genuinely public service served directly from the VPS. **Gotcha logged:** the NetBird per-client resolver (`100.122.255.254`) caches dnsmasq answers and does **not** clear on `netbird down/up`; clients needed `/etc/hosts` overrides or `resolvectl flush-caches` to pick up the change. Since the service is now fully public, the long-term cleaner option is to drop the override entirely and let it fall through to the IONOS wildcard (which also points at the VPS).