DNS single-source Phase 1 + decommission Tailscale fleet-wide

Phase 1 of the DNS-redundancy cleanup (keep NetBird, collapse toward one
zone) — the safe, mesh-independent half:

- Every homelab LXC now resolves via Technitium (192.168.8.2). Fixed 8
  boxes on a dead resolver (.180), the router (.1), or Tailscale MagicDNS
  (100.100.100.100): 101,102,104,105,106,114,119,126.
- Removed the redundant /etc/hosts auth/mcp/secrets overrides (Technitium
  returns identical-or-better answers); disabled hubris-hosts-override.
- Net effect: on-prem DNS (LXCs + household via Fritz!Box->Technitium) is
  now NetBird-independent, so dropping the managed zone later can't break
  on-LAN resolution. Phases 2-4 still pending.

Tailscale decommissioned (was legacy/being-phased-out):
- Removed from the 6 LXCs still running it (101,103,104,105,114,119):
  logout, disable tailscaled, apt purge, state cleared.
- inventory.yaml: dropped tailscale from accepted + all mesh blocks;
  regenerated hosts/*.yaml (also pruned orphan authentik/claudio-bot).
- Tightened secrets-issuance MESH_SUBNETS: removed the now-vestigial
  Tailscale CGNAT range 100.64.0.0/10.
- Updated narrative docs (mesh, dns, network, README, AGENTS,
  agent-enrollment, homelab-context, 105-apps, 107-dns).

Live infra changed on the fleet + Mac; this commit records the docs/inventory.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hosts/apps.yaml

@@ -8,15 +8,10 @@ role: docker-apps
 host: hubris
 pve_id: 105
 lan_ip: 192.168.8.205
-mesh:
-  tailscale:
-    ip: 100.121.171.122
-    fqdn: apps
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_hosts:

hosts/arriman.yaml

@@ -8,14 +8,10 @@ role: arr-stack
 host: hubris
 pve_id: 122
 lan_ip: 192.168.8.132
-mesh:
-  tailscale:
-    fqdn: arr
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_hosts:

hosts/authentik.yaml

@@ -1,32 +0,0 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
-# Source of truth: ../inventory.yaml
-name: authentik
-kind: lxc
-os: linux
-role: idp
-host: hubris
-pve_id: 124
-lan_ip: 192.168.8.180
-mesh_globals:
-  primary: netbird
-  accepted:
-  - netbird
-  - tailscale
-public_host: auth.hubris.network
-runs:
-- authentik
-- dnsmasq
-services_hosted:
-- name: authentik
-  url: https://auth.hubris.network
-  backend: authentik
-- name: dnsmasq
-  backend: authentik
-  note: split-horizon DNS, /etc/dnsmasq.d/hubris-split.conf
-notes:
-- 'Also hosts split-horizon dnsmasq: /etc/dnsmasq.d/hubris-split.conf'
-see_also:
-- containers/124-authentik.md
-mcp_endpoint: https://mcp.hubris.network/mcp
-secrets_issuance_endpoint: https://secrets.hubris.network/issue

hosts/caddy.yaml

@@ -12,7 +12,6 @@ mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 peers:
 - authentik
 - gitea

hosts/claudio-bot.yaml

@@ -1,23 +0,0 @@
-# DEPRECATED — LXC 123 destroyed 2026-06-04. Replaced by Hermes Agent.
-# Generated by mcp/build_host_files.py from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
-# Source of truth: ../inventory.yaml
-name: claudio-bot
-kind: lxc
-os: linux
-role: matrix-agent
-host: hubris
-pve_id: 123
-lan_ip: 192.168.8.230
-mesh_globals:
-  primary: netbird
-  accepted:
-  - netbird
-  - tailscale
-notes:
-- Reads /opt/homelab-context/ on startup
-age_pubkey: age1xmkeq968areza2necqyq0065dpeegngzyr6dhagh0n6pl33lccfqe5mqn9
-see_also:
-- containers/123-claudio-bot.md
-mcp_endpoint: https://mcp.hubris.network/mcp
-secrets_issuance_endpoint: https://secrets.hubris.network/issue

hosts/elementsynapse.yaml

@@ -7,15 +7,11 @@ os: linux
 role: matrix-server
 host: hubris
 pve_id: 118
-lan_ip: 192.168.8.239 # static; was DHCP drifting to .244 — fixed by setting iface eth0 inet static
-mesh:
-  tailscale:
-    fqdn: elementsynapse
+lan_ip: 192.168.8.239
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 public_host: matrix.hubris.network
 runs:
 - matrix

hosts/gitea.yaml

@@ -8,14 +8,10 @@ role: git-server
 host: hubris
 pve_id: 104
 lan_ip: 192.168.8.121
-mesh:
-  tailscale:
-    fqdn: gitea
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: git.hubris.network

hosts/haos.yaml

@@ -8,14 +8,10 @@ role: home-automation
 host: hubris
 pve_id: 108
 lan_ip: 192.168.8.101
-mesh:
-  tailscale:
-    fqdn: homeassistant
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 runs:
 - haos
 services_hosted:

hosts/hubris.yaml

@@ -14,7 +14,6 @@ mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library
 ssh:

hosts/jellyfin.yaml

@@ -8,14 +8,10 @@ role: media-server
 host: hubris
 pve_id: 101
 lan_ip: 192.168.8.206
-mesh:
-  tailscale:
-    fqdn: jellyfin
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: media.hubris.network

hosts/ludo-mini.yaml

@@ -5,6 +5,7 @@ name: ludo-mini
 kind: workstation
 os: linux
 role: dev
+lan_ip: 192.168.178.181
 mesh:
   netbird:
     fqdn: ludo-mini.netbird.selfhosted
@@ -12,6 +13,7 @@ mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
+ssh:
+  user: dtoro
 mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue

hosts/mac-mini.yaml

@@ -5,7 +5,7 @@ name: mac-mini
 kind: workstation
 os: macos
 role: dev
-lan_ip: 192.168.8.174
+lan_ip: 192.168.178.182
 mesh:
   netbird:
     fqdn: mac-mini-234-17.netbird.selfhosted
@@ -13,7 +13,6 @@ mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 ssh:
   user: dtoro
 notes:

hosts/mule-images.yaml

@@ -8,14 +8,10 @@ role: photo-management
 host: hubris
 pve_id: 120
 lan_ip: 192.168.8.136
-mesh:
-  tailscale:
-    fqdn: muleimage
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: photos.hubris.network

hosts/netbird-vps.yaml

@@ -13,7 +13,6 @@ mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 ssh:
   user: root
 notes:

hosts/nextcloud.yaml

@@ -8,14 +8,10 @@ role: file-sync
 host: hubris
 pve_id: 114
 lan_ip: 192.168.8.224
-mesh:
-  tailscale:
-    fqdn: nextcloud
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: cloud.hubris.network

hosts/nfs-export.yaml

@@ -12,7 +12,6 @@ mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 see_also:
 - containers/102-nfs-export.md
 mcp_endpoint: https://mcp.hubris.network/mcp

hosts/paperless.yaml

@@ -8,14 +8,10 @@ role: document-archive
 host: hubris
 pve_id: 103
 lan_ip: 192.168.8.130
-mesh:
-  tailscale:
-    fqdn: paperless
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: paperless.hubris.network

hosts/plato.yaml

@@ -12,7 +12,6 @@ mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library/documents/plato
 public_host: plato.hubris.network

hosts/republic-laptop.yaml

@@ -12,7 +12,6 @@ mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 ssh:
   user: dtoro
 mcp_endpoint: https://mcp.hubris.network/mcp

hosts/sophia.yaml

@@ -8,14 +8,10 @@ role: workshop
 host: hubris
 pve_id: 119
 lan_ip: 192.168.8.109
-mesh:
-  tailscale:
-    fqdn: sophia
 mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 mounts:
 - /mnt/library
 see_also:

hosts/zimaos.yaml

@@ -12,7 +12,6 @@ mesh_globals:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
 public_host: zimaos.hubris.network
 runs:
 - zimaos