diff --git a/AGENTS.md b/AGENTS.md index 94c1ad0..55de4b1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -19,8 +19,8 @@ the operator to run `homelab client add ` from an existing client. - `/opt/homelab-context/inventory.yaml` — every host, LXC, VM, and workstation with their mesh addresses, roles, and service mappings. Treat this file as authoritative; anything you read in narrative pages should agree with it. -- `/opt/homelab-context/infrastructure/mesh.md` — Tailscale → Netbird state. - Both meshes are accepted today; Netbird is preferred for new traffic. +- `/opt/homelab-context/infrastructure/mesh.md` — Netbird mesh state. + Tailscale was decommissioned 2026-06-21; the fleet is Netbird-only. - `/opt/homelab-context/infrastructure/dns.md` — split-horizon DNS via dnsmasq on LXC 124. `*.hubris.network` resolves to 192.168.x.x on the LAN and to mesh addresses off-LAN. diff --git a/README.md b/README.md index 05ce373..b1298be 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,7 @@ See the full table in [`containers/index.md`](containers/index.md). Quick links: ### Cross-cutting infrastructure - [DNS — split-horizon](infrastructure/dns.md) - [Ingress — Caddy + VPS traefik](infrastructure/ingress.md) -- [Mesh — Tailscale → Netbird migration](infrastructure/mesh.md) +- [Mesh — Netbird overlay](infrastructure/mesh.md) - [Monitoring — Hermes health watchdog](infrastructure/monitoring.md) - [Media permissions — `media` GID 10000](infrastructure/media-permissions.md) - [SSH access](infrastructure/ssh-access.md) diff --git a/containers/105-apps.md b/containers/105-apps.md index 1477f10..33bcb3e 100644 --- a/containers/105-apps.md +++ b/containers/105-apps.md @@ -87,9 +87,10 @@ same key. Mesh+LAN source-IP gated via the `MESH_SUBNETS` env in - `/revoke` is admin-token-gated by `/etc/secrets-issuance/admin-token`; shreds the local key file and adds the hostname to the denylist. Called by `homelab client remove`. -- Trust subnets today: `100.122.0.0/16` (Netbird), `100.64.0.0/10` - (Tailscale), `192.168.8.0/24` (LAN). Tighten if the LAN gets - untrusted devices. +- Trust subnets today: `100.122.0.0/16` (Netbird), `192.168.8.0/24` (LAN). + (The legacy Tailscale CGNAT range `100.64.0.0/10` was removed from + `secrets-issuance`'s `MESH_SUBNETS` on 2026-06-21 when Tailscale was + decommissioned; service restarted.) Tighten if the LAN gets untrusted devices. #### Auto-deploy pipeline (secrets-issuance) Receiver at `/opt/secrets-issuance/secrets-issuance/deploy/webhook/`, diff --git a/containers/107-dns.md b/containers/107-dns.md index 3525f99..de81ddc 100644 --- a/containers/107-dns.md +++ b/containers/107-dns.md @@ -26,7 +26,7 @@ Authoritative split-horizon DNS for `hubris.network` on the LAN/mesh, plus recur ## Who points here - **NetBird mesh peers:** resolve via the **NetBird managed DNS zone**, kept in sync *from* this Technitium (see dns-sync below). The `home-lab-dns` nameserver group (`→ 192.168.8.2`) is a thin fallback forwarder. - **Homelab DHCP clients:** Technitium's own DHCP scope hands out `192.168.8.2` as the DNS server for `192.168.8.x` leases (see DHCP section below). -- **Plain LAN clients (`192.168.178.x`):** Fritz!Box DHCP still hands out Fritz!Box itself (`192.168.178.1`) as DNS — no split-horizon for non-mesh clients. Changing this requires a secondary DNS fallback, which Fritz!OS 8.x doesn't expose in a single DHCP field. +- **Plain LAN clients (`192.168.178.x`):** Fritz!Box DHCP still hands out Fritz!Box itself (`192.168.178.1`) as DNS, **but** the Fritz!Box now *forwards* upstream to Technitium — DNSv4 server set to `192.168.8.2` (Internet → Filter → DNS Server, 2026-06-17). So household clients get split-horizon `*.hubris.network` answers via Fritz!Box→Technitium, with **no NetBird dependency**. (This is the change that decoupled the on-prem tier from the mesh — see [dns.md](../infrastructure/dns.md) 2026-06-17.) ## dns-sync (Technitium = authoring source) `/opt/dns-sync/sync.py` (cron `*/10`, logs `/var/log/dns-sync.log`) reconciles this zone's named A-records → the NetBird managed DNS zone via the NetBird API (`/api/dns/zones/{id}/records`). Token at `/opt/dns-sync/netbird-token` (mode 600; source of truth in sops `secrets/netbird-pat.yaml`). **Edit DNS only here**; the sync propagates to the mesh. It deletes NetBird records absent from Technitium. Tracked: [scripts/dns-sync.py](../scripts/dns-sync.py). *Why this exists:* NetBird won't forward to Technitium for mesh peers (self-IP / nameserver-group quirks), so we sync into the managed zone instead — see [dns.md](../infrastructure/dns.md). diff --git a/hosts/apps.yaml b/hosts/apps.yaml index 7e3ee4c..e2fec15 100644 --- a/hosts/apps.yaml +++ b/hosts/apps.yaml @@ -8,15 +8,10 @@ role: docker-apps host: hubris pve_id: 105 lan_ip: 192.168.8.205 -mesh: - tailscale: - ip: 100.121.171.122 - fqdn: apps mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library public_hosts: diff --git a/hosts/arriman.yaml b/hosts/arriman.yaml index 15cdede..14eb184 100644 --- a/hosts/arriman.yaml +++ b/hosts/arriman.yaml @@ -8,14 +8,10 @@ role: arr-stack host: hubris pve_id: 122 lan_ip: 192.168.8.132 -mesh: - tailscale: - fqdn: arr mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library public_hosts: diff --git a/hosts/authentik.yaml b/hosts/authentik.yaml deleted file mode 100644 index 5a050bc..0000000 --- a/hosts/authentik.yaml +++ /dev/null @@ -1,32 +0,0 @@ -# Generated by mcp/build_host_files.py from inventory.yaml. -# Do NOT edit by hand — your changes will be overwritten. -# Source of truth: ../inventory.yaml -name: authentik -kind: lxc -os: linux -role: idp -host: hubris -pve_id: 124 -lan_ip: 192.168.8.180 -mesh_globals: - primary: netbird - accepted: - - netbird - - tailscale -public_host: auth.hubris.network -runs: -- authentik -- dnsmasq -services_hosted: -- name: authentik - url: https://auth.hubris.network - backend: authentik -- name: dnsmasq - backend: authentik - note: split-horizon DNS, /etc/dnsmasq.d/hubris-split.conf -notes: -- 'Also hosts split-horizon dnsmasq: /etc/dnsmasq.d/hubris-split.conf' -see_also: -- containers/124-authentik.md -mcp_endpoint: https://mcp.hubris.network/mcp -secrets_issuance_endpoint: https://secrets.hubris.network/issue diff --git a/hosts/caddy.yaml b/hosts/caddy.yaml index cc0adcc..9e1ac22 100644 --- a/hosts/caddy.yaml +++ b/hosts/caddy.yaml @@ -12,7 +12,6 @@ mesh_globals: primary: netbird accepted: - netbird - - tailscale peers: - authentik - gitea diff --git a/hosts/claudio-bot.yaml b/hosts/claudio-bot.yaml deleted file mode 100644 index 6725c22..0000000 --- a/hosts/claudio-bot.yaml +++ /dev/null @@ -1,23 +0,0 @@ -# DEPRECATED — LXC 123 destroyed 2026-06-04. Replaced by Hermes Agent. -# Generated by mcp/build_host_files.py from inventory.yaml. -# Do NOT edit by hand — your changes will be overwritten. -# Source of truth: ../inventory.yaml -name: claudio-bot -kind: lxc -os: linux -role: matrix-agent -host: hubris -pve_id: 123 -lan_ip: 192.168.8.230 -mesh_globals: - primary: netbird - accepted: - - netbird - - tailscale -notes: -- Reads /opt/homelab-context/ on startup -age_pubkey: age1xmkeq968areza2necqyq0065dpeegngzyr6dhagh0n6pl33lccfqe5mqn9 -see_also: -- containers/123-claudio-bot.md -mcp_endpoint: https://mcp.hubris.network/mcp -secrets_issuance_endpoint: https://secrets.hubris.network/issue diff --git a/hosts/elementsynapse.yaml b/hosts/elementsynapse.yaml index 9630c4f..ba95cdf 100644 --- a/hosts/elementsynapse.yaml +++ b/hosts/elementsynapse.yaml @@ -7,15 +7,11 @@ os: linux role: matrix-server host: hubris pve_id: 118 -lan_ip: 192.168.8.239 # static; was DHCP drifting to .244 — fixed by setting iface eth0 inet static -mesh: - tailscale: - fqdn: elementsynapse +lan_ip: 192.168.8.239 mesh_globals: primary: netbird accepted: - netbird - - tailscale public_host: matrix.hubris.network runs: - matrix diff --git a/hosts/gitea.yaml b/hosts/gitea.yaml index 87f25a2..3448f5c 100644 --- a/hosts/gitea.yaml +++ b/hosts/gitea.yaml @@ -8,14 +8,10 @@ role: git-server host: hubris pve_id: 104 lan_ip: 192.168.8.121 -mesh: - tailscale: - fqdn: gitea mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library public_host: git.hubris.network diff --git a/hosts/haos.yaml b/hosts/haos.yaml index 40e3e9c..d11afcc 100644 --- a/hosts/haos.yaml +++ b/hosts/haos.yaml @@ -8,14 +8,10 @@ role: home-automation host: hubris pve_id: 108 lan_ip: 192.168.8.101 -mesh: - tailscale: - fqdn: homeassistant mesh_globals: primary: netbird accepted: - netbird - - tailscale runs: - haos services_hosted: diff --git a/hosts/hubris.yaml b/hosts/hubris.yaml index bb156ce..6b0e4bd 100644 --- a/hosts/hubris.yaml +++ b/hosts/hubris.yaml @@ -14,7 +14,6 @@ mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library ssh: diff --git a/hosts/jellyfin.yaml b/hosts/jellyfin.yaml index c95f5a1..38a2949 100644 --- a/hosts/jellyfin.yaml +++ b/hosts/jellyfin.yaml @@ -8,14 +8,10 @@ role: media-server host: hubris pve_id: 101 lan_ip: 192.168.8.206 -mesh: - tailscale: - fqdn: jellyfin mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library public_host: media.hubris.network diff --git a/hosts/ludo-mini.yaml b/hosts/ludo-mini.yaml index cc44feb..a459328 100644 --- a/hosts/ludo-mini.yaml +++ b/hosts/ludo-mini.yaml @@ -5,6 +5,7 @@ name: ludo-mini kind: workstation os: linux role: dev +lan_ip: 192.168.178.181 mesh: netbird: fqdn: ludo-mini.netbird.selfhosted @@ -12,6 +13,7 @@ mesh_globals: primary: netbird accepted: - netbird - - tailscale +ssh: + user: dtoro mcp_endpoint: https://mcp.hubris.network/mcp secrets_issuance_endpoint: https://secrets.hubris.network/issue diff --git a/hosts/mac-mini.yaml b/hosts/mac-mini.yaml index 829ebd6..0dc9d07 100644 --- a/hosts/mac-mini.yaml +++ b/hosts/mac-mini.yaml @@ -5,7 +5,7 @@ name: mac-mini kind: workstation os: macos role: dev -lan_ip: 192.168.8.174 +lan_ip: 192.168.178.182 mesh: netbird: fqdn: mac-mini-234-17.netbird.selfhosted @@ -13,7 +13,6 @@ mesh_globals: primary: netbird accepted: - netbird - - tailscale ssh: user: dtoro notes: diff --git a/hosts/mule-images.yaml b/hosts/mule-images.yaml index 75b8633..6a7a647 100644 --- a/hosts/mule-images.yaml +++ b/hosts/mule-images.yaml @@ -8,14 +8,10 @@ role: photo-management host: hubris pve_id: 120 lan_ip: 192.168.8.136 -mesh: - tailscale: - fqdn: muleimage mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library public_host: photos.hubris.network diff --git a/hosts/netbird-vps.yaml b/hosts/netbird-vps.yaml index 713a0bb..39d7638 100644 --- a/hosts/netbird-vps.yaml +++ b/hosts/netbird-vps.yaml @@ -13,7 +13,6 @@ mesh_globals: primary: netbird accepted: - netbird - - tailscale ssh: user: root notes: diff --git a/hosts/nextcloud.yaml b/hosts/nextcloud.yaml index a0f5a39..f6ddf4b 100644 --- a/hosts/nextcloud.yaml +++ b/hosts/nextcloud.yaml @@ -8,14 +8,10 @@ role: file-sync host: hubris pve_id: 114 lan_ip: 192.168.8.224 -mesh: - tailscale: - fqdn: nextcloud mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library public_host: cloud.hubris.network diff --git a/hosts/nfs-export.yaml b/hosts/nfs-export.yaml index a38c1b4..44e6959 100644 --- a/hosts/nfs-export.yaml +++ b/hosts/nfs-export.yaml @@ -12,7 +12,6 @@ mesh_globals: primary: netbird accepted: - netbird - - tailscale see_also: - containers/102-nfs-export.md mcp_endpoint: https://mcp.hubris.network/mcp diff --git a/hosts/paperless.yaml b/hosts/paperless.yaml index 71b5372..a99fba9 100644 --- a/hosts/paperless.yaml +++ b/hosts/paperless.yaml @@ -8,14 +8,10 @@ role: document-archive host: hubris pve_id: 103 lan_ip: 192.168.8.130 -mesh: - tailscale: - fqdn: paperless mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library public_host: paperless.hubris.network diff --git a/hosts/plato.yaml b/hosts/plato.yaml index e391ff2..9244845 100644 --- a/hosts/plato.yaml +++ b/hosts/plato.yaml @@ -12,7 +12,6 @@ mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library/documents/plato public_host: plato.hubris.network diff --git a/hosts/republic-laptop.yaml b/hosts/republic-laptop.yaml index 23fad6a..c45128b 100644 --- a/hosts/republic-laptop.yaml +++ b/hosts/republic-laptop.yaml @@ -12,7 +12,6 @@ mesh_globals: primary: netbird accepted: - netbird - - tailscale ssh: user: dtoro mcp_endpoint: https://mcp.hubris.network/mcp diff --git a/hosts/sophia.yaml b/hosts/sophia.yaml index 222e00f..e3a2afc 100644 --- a/hosts/sophia.yaml +++ b/hosts/sophia.yaml @@ -8,14 +8,10 @@ role: workshop host: hubris pve_id: 119 lan_ip: 192.168.8.109 -mesh: - tailscale: - fqdn: sophia mesh_globals: primary: netbird accepted: - netbird - - tailscale mounts: - /mnt/library see_also: diff --git a/hosts/zimaos.yaml b/hosts/zimaos.yaml index 8b2a553..f21896a 100644 --- a/hosts/zimaos.yaml +++ b/hosts/zimaos.yaml @@ -12,7 +12,6 @@ mesh_globals: primary: netbird accepted: - netbird - - tailscale public_host: zimaos.hubris.network runs: - zimaos diff --git a/infrastructure/dns.md b/infrastructure/dns.md index 218c0d3..90c22c9 100644 --- a/infrastructure/dns.md +++ b/infrastructure/dns.md @@ -9,7 +9,7 @@ There is **no wildcard on the LAN side**. Every subdomain needs an explicit entr - **Authoritative public DNS:** IONOS. `*.hubris.network → 82.165.190.79` (was `74.118.126.4` until 2026-04-22). - **LAN authoritative for `hubris.network` records:** [Technitium DNS](https://technitium.com) on [dns (107)](../containers/107-dns.md) at `192.168.8.2:53`. Syncs A records to the NetBird managed DNS zone via cron (see [dns-sync.py](../scripts/dns-sync.py)). Formerly dnsmasq on [authentik (124)](../containers/124-authentik.md) (decommissioned 2026-06-04). - **PVE host** (`192.168.8.77`): resolver is the local Netbird daemon at `100.122.38.109:53`, which forwards to the LAN/upstream and learns hubris.network answers via that path. `netbird status` says "Nameservers: 0/0 Available" — confirming netbird does NOT manage a hubris.network zone; it just caches whatever the system resolver returns. -- **Some LXCs** keep router DNS (`192.168.8.1`) or Tailscale MagicDNS (`100.100.100.100`), both of which return the public IONOS A record. Those LXCs need either a `/etc/hosts` override or local dnsmasq — see [mesh migration](mesh.md) for which technique applies where. +- **All LXCs** now point at Technitium (`192.168.8.2`) directly (since 2026-06-21 — see changelog). The earlier mix of router DNS (`192.168.8.1`) / Tailscale MagicDNS (`100.100.100.100`) — which returned the public IONOS A record and forced `/etc/hosts` overrides — has been removed. ## Live entries (as of 2026-06-04) @@ -76,6 +76,18 @@ Either: ## Changelog +### 2026-06-21 — DNS single-source, Phase 1: on-prem LXCs decoupled from NetBird +Goal: collapse the three overlapping DNS sources (Technitium + NetBird managed zone + per-LXC band-aids) toward **one zone**, keeping NetBird. Phase 1 (the safe, mesh-independent half) is done: + +- **Every homelab LXC now resolves via Technitium (`192.168.8.2`).** Fixed 8 boxes that were on a dead resolver, the router, or Tailscale MagicDNS: + - `192.168.8.180` (dead ex-Authentik): 102, 106, 126 + - `192.168.8.1` (router → public answer): 101 + - `100.100.100.100` (Tailscale MagicDNS): 104, 105, 114, 119 — also ran `tailscale set --accept-dns=false` so `tailscaled` stops rewriting `/etc/resolv.conf`. + - Already correct (`.2`): 103, 118, 120, 121, 122. CT 107 stays on `1.1.1.1` by design (no self-dependency). +- **Removed the redundant `/etc/hosts` band-aids** (`auth`/`mcp`/`secrets` → `192.168.8.175`) on 101, 103, 104, 105, 114, 118, 120, 121, 122, 126; disabled `hubris-hosts-override.service` where enabled. Backups at `/etc/hosts.bak-dnsplan`. PVE-managed lines and self-hostname maps preserved. Technitium already returns identical-or-better answers (verified: `auth → 82.165.190.79`, `mcp`/`secrets`/`cloud`/`git` → `192.168.8.175`). +- **Nextcloud (114):** its documented Guzzle-workaround dnsmasq is not running; resolves correctly straight from Technitium, so no special-casing remains. +- Net effect: **NetBird's DNS now only matters for off-LAN roaming peers** (Tier 2). On-prem (LXCs + household via Fritz!Box→Technitium) is fully NetBird-independent — so dropping the managed zone later can no longer break on-LAN resolution. Phases 2–4 (mesh-IP forwarding, roaming test, managed-zone + sync deletion) still pending. + ### 2026-06-17 — Fritz!Box DNSv4 server set to Technitium; old limitation resolved Household LAN clients (192.168.178.x) now resolve `*.hubris.network` to LAN IPs — the limitation noted below is resolved. Configured at Fritz!Box Internet → Filter → DNS Server → DNSv4 Server = `192.168.8.2` (User-defined). Authentik LXC 124 (192.168.8.180) destroyed — Authentik runs on VPS, DNS on Technitium (107). diff --git a/infrastructure/homelab-context.md b/infrastructure/homelab-context.md index fb58481..c51a4e2 100644 --- a/infrastructure/homelab-context.md +++ b/infrastructure/homelab-context.md @@ -64,9 +64,11 @@ The MCP server and secrets-issuance each have their own clone - Both services bind `0.0.0.0:`. The trust boundary is `MESH_SUBNETS` in the service's environment + nftables (planned). Today - `MESH_SUBNETS=100.122.0.0/16,100.64.0.0/10,192.168.8.0/24` — Netbird + - Tailscale + the homelab LAN. Adjust if the LAN ever has untrusted - devices. + `MESH_SUBNETS=100.122.0.0/16,192.168.8.0/24` — Netbird + the homelab LAN. + (The legacy Tailscale CGNAT range `100.64.0.0/10` was dropped 2026-06-21 + when Tailscale was decommissioned; secrets-issuance restarted. Only + secrets-issuance reads `MESH_SUBNETS` — homelab-mcp does not.) Adjust if + the LAN ever has untrusted devices. - Caddy fronts both with Let's Encrypt certs via the IONOS DNS challenge: `mcp.hubris.network` → `192.168.8.205:9810`, `secrets.hubris.network` → `192.168.8.205:9820`. Off-LAN clients on @@ -125,7 +127,7 @@ The MCP server and secrets-issuance each have their own clone step-by-step for adding a new client - [Auto-deploy](auto-deploy.md) — the `homelab-mcp` + `secrets-issuance` pipelines (and the rest of the lab's webhook pipelines) -- [Mesh](mesh.md) — Netbird / Tailscale paths and the `192.168.8.0/24` +- [Mesh](mesh.md) — Netbird paths and the `192.168.8.0/24` network resource - [Apps (105)](../containers/105-apps.md) — where both services run - [Gitea (104)](../containers/104-gitea.md) — the source of truth diff --git a/infrastructure/mesh.md b/infrastructure/mesh.md index 1d7d78b..4922eb8 100644 --- a/infrastructure/mesh.md +++ b/infrastructure/mesh.md @@ -1,12 +1,12 @@ -# Mesh — Tailscale → Netbird migration +# Mesh — Netbird -The hubris fleet is migrating from Tailscale to Netbird. Netbird is the target end-state. In-progress as of 2026-04-21. +The hubris fleet runs on Netbird. Tailscale — the previous overlay — was **fully decommissioned on 2026-06-21**: removed from the 6 LXCs that still ran it (101, 103, 104, 105, 114, 119), apt package + state purged, `tailscaled` disabled. The fleet is now Netbird-only. (Historical migration notes below are kept for context.) ## Current state - **PVE host** uses Netbird (`wt0`, `100.122.38.109/16`). Its resolver is the local netbird daemon, which forwards to LAN/upstream — so the PVE host gets `*.hubris.network → 192.168.8.175` via the system resolver chain. - **Netbird mgmt host** (`82.165.190.79`, FQDN `inspiring-ramanujan.netbird.selfhosted`, NB IP `100.122.165.149`) is now itself a peer on the mesh (joined 2026-04-22 via setup key, netbird 0.69.0). Routes the homelab network (`192.168.8.0/24`) via the PVE peer. This gives the mgmt host LAN access *and* split-horizon DNS for `*.hubris.network`. Useful independently of any Authentik integration. -- **Most LXCs** still run Tailscale or use router DNS (`192.168.8.1`) / Tailscale MagicDNS (`100.100.100.100`), both of which return the *public* IONOS A record `*.hubris.network → 82.165.190.79`. The VPS only routes hostnames it actually publishes (today, `artifacto` + `blog`), so this path is a dead end for any LAN-only service. +- **All LXCs** now resolve via Technitium (`192.168.8.2`) directly — as of the 2026-06-21 DNS single-source work (Phase 1). The previous mix of router DNS (`192.168.8.1`) / Tailscale MagicDNS (`100.100.100.100`) returned the *public* IONOS A record and is gone. See [dns.md changelog 2026-06-21](dns.md). ## ICE / STUN / TURN @@ -45,6 +45,8 @@ Pre-migration, the bundled `netbirdio/netbird-server` combined image silently ig ## Consequence — every LXC wired to Authentik needs an internal override +> **RESOLVED 2026-06-21 (DNS single-source, Phase 1).** Every homelab LXC now points its resolver directly at **Technitium (`192.168.8.2`)**, which answers the full split-horizon zone (`auth → 82.165.190.79`, everything else → Caddy `192.168.8.175`). The per-LXC `/etc/hosts` overrides and Tailscale-MagicDNS/dead-`.180`/router resolvers below were removed; `hubris-hosts-override.service` disabled where present. The section is kept for history. See [dns.md changelog 2026-06-21](dns.md). + Until each LXC is migrated to Netbird, anything that needs to reach `auth.hubris.network` (Authentik), `cloud.hubris.network` (Nextcloud), etc., must override the public answer with `192.168.8.175`. Two techniques. Pick by HTTP-client behavior. @@ -90,7 +92,7 @@ pct set --nameserver "127.0.0.1 192.168.8.1 1.1.1.1" ## Adding new LXCs - Don't add new LXCs to Tailscale; add them to Netbird. Tailscale is being decommissioned on hubris. -- When wiring a new app into Authentik: `cat /etc/resolv.conf` on the target LXC. If nameserver is `192.168.8.1` or `100.100.100.100`, add the hosts override. If it's the netbird daemon IP, skip. +- When wiring a new app into Authentik: `cat /etc/resolv.conf` on the target LXC. It should be `192.168.8.2` (Technitium), which returns correct split-horizon answers — no `/etc/hosts` override needed. (Historically, boxes on `192.168.8.1`/`100.100.100.100` needed an override; those resolvers were removed 2026-06-21.) ## Long-term fix diff --git a/infrastructure/network.md b/infrastructure/network.md index 54ded7b..3fb2cad 100644 --- a/infrastructure/network.md +++ b/infrastructure/network.md @@ -64,14 +64,14 @@ No NAT on Proxmox — traffic flows without double-NAT. ## Remote access -- **NetBird mesh** — primary path for remote administration. Authenticated via [Authentik on the VPS](../vps/). -- **Tailscale** — legacy, being phased out. See [mesh.md](mesh.md). +- **NetBird mesh** — the remote-administration path. Authenticated via [Authentik on the VPS](../vps/). +- Tailscale (the previous overlay) was **decommissioned 2026-06-21**. See [mesh.md](mesh.md). ## Related - [DNS](dns.md) — split-horizon config and entry list - [Ingress](ingress.md) — public entry points via VPS traefik -- [Mesh](mesh.md) — NetBird / Tailscale VPN overlay +- [Mesh](mesh.md) — NetBird VPN overlay - [hosts/hubris.md](../hosts/hubris.md) — Proxmox host (vmbr0/vmbr1 config) - [CT 107 — dns](../containers/107-dns.md) — Technitium DNS + DHCP server diff --git a/inventory.yaml b/inventory.yaml index fa560f8..d651fc3 100644 --- a/inventory.yaml +++ b/inventory.yaml @@ -11,8 +11,8 @@ # ("external" is reserved for hosts the homelab CLI manages via ssh but # that aren't homelab clients themselves — e.g. the IONOS netbird VPS # with no /etc/age/key.txt and no /opt/homelab-context clone.) -# - `mesh:` lists addresses the host is reachable at. Both `netbird` and -# `tailscale` are accepted during the migration (see infrastructure/mesh.md). +# - `mesh:` lists addresses the host is reachable at via `netbird`. +# (Tailscale was decommissioned 2026-06-21 — see infrastructure/mesh.md.) # Prefer netbird FQDNs over raw IPs. # - `age_pubkey:` provisioned by secrets-issuance on first bootstrap and # committed back via `homelab client add --finalize-pubkey `. @@ -32,7 +32,6 @@ mesh: primary: netbird accepted: - netbird - - tailscale netbird_subnet: 100.122.0.0/16 netbird_domain: netbird.selfhosted services: @@ -125,9 +124,6 @@ hosts: role: media-server lan_ip: 192.168.8.206 public_host: media.hubris.network - mesh: - tailscale: - fqdn: jellyfin mounts: - /mnt/library age_pubkey: '' @@ -146,9 +142,6 @@ hosts: role: document-archive lan_ip: 192.168.8.130 public_host: paperless.hubris.network - mesh: - tailscale: - fqdn: paperless mounts: - /mnt/library age_pubkey: '' @@ -161,9 +154,6 @@ hosts: lan_ip: 192.168.8.121 public_host: git.hubris.network backend_port: 3000 - mesh: - tailscale: - fqdn: gitea mounts: - /mnt/library notes: @@ -178,10 +168,6 @@ hosts: lan_ip: 192.168.8.205 public_hosts: - artifacto.hubris.network - mesh: - tailscale: - ip: 100.121.171.122 - fqdn: apps mounts: - /mnt/library runs: @@ -198,9 +184,6 @@ hosts: role: file-sync lan_ip: 192.168.8.224 public_host: cloud.hubris.network - mesh: - tailscale: - fqdn: nextcloud mounts: - /mnt/library age_pubkey: '' @@ -212,9 +195,6 @@ hosts: role: matrix-server lan_ip: 192.168.8.239 public_host: matrix.hubris.network - mesh: - tailscale: - fqdn: elementsynapse sophia: kind: lxc pve_id: 119 @@ -222,9 +202,6 @@ hosts: os: linux role: workshop lan_ip: 192.168.8.109 - mesh: - tailscale: - fqdn: sophia mounts: - /mnt/library age_pubkey: '' @@ -236,9 +213,6 @@ hosts: role: photo-management lan_ip: 192.168.8.136 public_host: photos.hubris.network - mesh: - tailscale: - fqdn: muleimage mounts: - /mnt/library age_pubkey: '' @@ -266,9 +240,6 @@ hosts: - jellyseerr.hubris.network - qbit.hubris.network - sab.hubris.network - mesh: - tailscale: - fqdn: arr mounts: - /mnt/library age_pubkey: '' @@ -299,9 +270,6 @@ hosts: os: linux role: home-automation lan_ip: 192.168.8.101 - mesh: - tailscale: - fqdn: homeassistant republic-laptop: kind: workstation os: linux diff --git a/operations/agent-enrollment.md b/operations/agent-enrollment.md index a615c00..3354ab0 100644 --- a/operations/agent-enrollment.md +++ b/operations/agent-enrollment.md @@ -18,7 +18,7 @@ operational reference is here. | --- | --- | --- | | Hostname matches an entry in `inventory.yaml` | The bootstrap looks up `hosts/$(hostname).yaml`. | `hostname` (Linux) / `scutil --get LocalHostName` (macOS) | | OS is Linux or macOS | bootstrap detects via `uname -s` | `uname -s` | -| On the mesh (Netbird or Tailscale) **or** on the LAN | issuance is gated to mesh + LAN subnets. **For Netbird: use a setup-key, not interactive auth** — see "Getting onto Netbird" below. | `netbird status` / `tailscale status` | +| On the Netbird mesh **or** on the LAN | issuance is gated to mesh + LAN subnets. **For Netbird: use a setup-key, not interactive auth** — see "Getting onto Netbird" below. | `netbird status` | | `git`, `python3`, `python3-yaml`, `age`, `sops` | bootstrap preflight; `homelab` CLI imports yaml | See per-OS commands below | | Can resolve `*.hubris.network` | bootstrap calls `https://secrets.hubris.network/issue` and writes `https://mcp.hubris.network/mcp` | `dig +short mcp.hubris.network` (should return `192.168.8.175`) |