DNS single-source Phase 1 + decommission Tailscale fleet-wide

Phase 1 of the DNS-redundancy cleanup (keep NetBird, collapse toward one zone) — the safe, mesh-independent half: - Every homelab LXC now resolves via Technitium (192.168.8.2). Fixed 8 boxes on a dead resolver (.180), the router (.1), or Tailscale MagicDNS (100.100.100.100): 101,102,104,105,106,114,119,126. - Removed the redundant /etc/hosts auth/mcp/secrets overrides (Technitium returns identical-or-better answers); disabled hubris-hosts-override. - Net effect: on-prem DNS (LXCs + household via Fritz!Box->Technitium) is now NetBird-independent, so dropping the managed zone later can't break on-LAN resolution. Phases 2-4 still pending. Tailscale decommissioned (was legacy/being-phased-out): - Removed from the 6 LXCs still running it (101,103,104,105,114,119): logout, disable tailscaled, apt purge, state cleared. - inventory.yaml: dropped tailscale from accepted + all mesh blocks; regenerated hosts/*.yaml (also pruned orphan authentik/claudio-bot). - Tightened secrets-issuance MESH_SUBNETS: removed the now-vestigial Tailscale CGNAT range 100.64.0.0/10. - Updated narrative docs (mesh, dns, network, README, AGENTS, agent-enrollment, homelab-context, 105-apps, 107-dns). Live infra changed on the fleet + Mac; this commit records the docs/inventory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-21 15:14:07 +02:00
parent a5da521751
commit 85457095e4
31 changed files with 44 additions and 161 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -19,8 +19,8 @@ the operator to run `homelab client add <hostname>` from an existing client.
 - `/opt/homelab-context/inventory.yaml` — every host, LXC, VM, and workstation
  with their mesh addresses, roles, and service mappings. Treat this file as
  authoritative; anything you read in narrative pages should agree with it.
- `/opt/homelab-context/infrastructure/mesh.md` — Tailscale → Netbird state.
-  Both meshes are accepted today; Netbird is preferred for new traffic.
+- `/opt/homelab-context/infrastructure/mesh.md` — Netbird mesh state.
+  Tailscale was decommissioned 2026-06-21; the fleet is Netbird-only.
 - `/opt/homelab-context/infrastructure/dns.md` — split-horizon DNS via
  dnsmasq on LXC 124. `*.hubris.network` resolves to 192.168.x.x on the LAN
  and to mesh addresses off-LAN.
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ See the full table in [`containers/index.md`](containers/index.md). Quick links:
 ### Cross-cutting infrastructure
 - [DNS — split-horizon](infrastructure/dns.md)
 - [Ingress — Caddy + VPS traefik](infrastructure/ingress.md)
- [Mesh — Tailscale → Netbird migration](infrastructure/mesh.md)
+- [Mesh — Netbird overlay](infrastructure/mesh.md)
 - [Monitoring — Hermes health watchdog](infrastructure/monitoring.md)
 - [Media permissions — `media` GID 10000](infrastructure/media-permissions.md)
 - [SSH access](infrastructure/ssh-access.md)
--- a/containers/105-apps.md
+++ b/containers/105-apps.md
@@ -87,9 +87,10 @@ same key. Mesh+LAN source-IP gated via the `MESH_SUBNETS` env in
 - `/revoke` is admin-token-gated by `/etc/secrets-issuance/admin-token`;
  shreds the local key file and adds the hostname to the denylist.
  Called by `homelab client remove`.
- Trust subnets today: `100.122.0.0/16` (Netbird), `100.64.0.0/10`
-  (Tailscale), `192.168.8.0/24` (LAN). Tighten if the LAN gets
-  untrusted devices.
+- Trust subnets today: `100.122.0.0/16` (Netbird), `192.168.8.0/24` (LAN).
+  (The legacy Tailscale CGNAT range `100.64.0.0/10` was removed from
+  `secrets-issuance`'s `MESH_SUBNETS` on 2026-06-21 when Tailscale was
+  decommissioned; service restarted.) Tighten if the LAN gets untrusted devices.

 #### Auto-deploy pipeline (secrets-issuance)
 Receiver at `/opt/secrets-issuance/secrets-issuance/deploy/webhook/`,
--- a/containers/107-dns.md
+++ b/containers/107-dns.md
@@ -26,7 +26,7 @@ Authoritative split-horizon DNS for `hubris.network` on the LAN/mesh, plus recur
 ## Who points here
 - **NetBird mesh peers:** resolve via the **NetBird managed DNS zone**, kept in sync *from* this Technitium (see dns-sync below). The `home-lab-dns` nameserver group (`→ 192.168.8.2`) is a thin fallback forwarder.
 - **Homelab DHCP clients:** Technitium's own DHCP scope hands out `192.168.8.2` as the DNS server for `192.168.8.x` leases (see DHCP section below).
- **Plain LAN clients (`192.168.178.x`):** Fritz!Box DHCP still hands out Fritz!Box itself (`192.168.178.1`) as DNS — no split-horizon for non-mesh clients. Changing this requires a secondary DNS fallback, which Fritz!OS 8.x doesn't expose in a single DHCP field.
+- **Plain LAN clients (`192.168.178.x`):** Fritz!Box DHCP still hands out Fritz!Box itself (`192.168.178.1`) as DNS, **but** the Fritz!Box now *forwards* upstream to Technitium — DNSv4 server set to `192.168.8.2` (Internet → Filter → DNS Server, 2026-06-17). So household clients get split-horizon `*.hubris.network` answers via Fritz!Box→Technitium, with **no NetBird dependency**. (This is the change that decoupled the on-prem tier from the mesh — see [dns.md](../infrastructure/dns.md) 2026-06-17.)

 ## dns-sync (Technitium = authoring source)
 `/opt/dns-sync/sync.py` (cron `*/10`, logs `/var/log/dns-sync.log`) reconciles this zone's named A-records → the NetBird managed DNS zone via the NetBird API (`/api/dns/zones/{id}/records`). Token at `/opt/dns-sync/netbird-token` (mode 600; source of truth in sops `secrets/netbird-pat.yaml`). **Edit DNS only here**; the sync propagates to the mesh. It deletes NetBird records absent from Technitium. Tracked: [scripts/dns-sync.py](../scripts/dns-sync.py). *Why this exists:* NetBird won't forward to Technitium for mesh peers (self-IP / nameserver-group quirks), so we sync into the managed zone instead — see [dns.md](../infrastructure/dns.md).
--- a/hosts/apps.yaml
+++ b/hosts/apps.yaml
@@ -8,15 +8,10 @@ role: docker-apps
 host: hubris
 pve_id: 105
 lan_ip: 192.168.8.205
-mesh:
-  tailscale:
-    ip: 100.121.171.122
-    fqdn: apps
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_hosts:
--- a/hosts/arriman.yaml
+++ b/hosts/arriman.yaml
@@ -8,14 +8,10 @@ role: arr-stack
 host: hubris
 pve_id: 122
 lan_ip: 192.168.8.132
-mesh:
-  tailscale:
-    fqdn: arr
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_hosts:
--- a/hosts/authentik.yaml
+++ b/hosts/authentik.yaml
@@ -1,32 +0,0 @@
-# Generated by mcp/build_host_files.py from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
-# Source of truth: ../inventory.yaml
-name: authentik
-kind: lxc
-os: linux
-role: idp
-host: hubris
-pve_id: 124
-lan_ip: 192.168.8.180
-mesh_globals:
-  primary: netbird
-  accepted:
-  - netbird
-  - tailscale
-public_host: auth.hubris.network
-runs:
- authentik
- dnsmasq
-services_hosted:
- name: authentik
-  url: https://auth.hubris.network
-  backend: authentik
- name: dnsmasq
-  backend: authentik
-  note: split-horizon DNS, /etc/dnsmasq.d/hubris-split.conf
-notes:
- 'Also hosts split-horizon dnsmasq: /etc/dnsmasq.d/hubris-split.conf'
-see_also:
- containers/124-authentik.md
-mcp_endpoint: https://mcp.hubris.network/mcp
-secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/caddy.yaml
+++ b/hosts/caddy.yaml
@@ -12,7 +12,6 @@ mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 peers:
 - authentik
 - gitea
--- a/hosts/claudio-bot.yaml
+++ b/hosts/claudio-bot.yaml
@@ -1,23 +0,0 @@
-# DEPRECATED — LXC 123 destroyed 2026-06-04. Replaced by Hermes Agent.
-# Generated by mcp/build_host_files.py from inventory.yaml.
-# Do NOT edit by hand — your changes will be overwritten.
-# Source of truth: ../inventory.yaml
-name: claudio-bot
-kind: lxc
-os: linux
-role: matrix-agent
-host: hubris
-pve_id: 123
-lan_ip: 192.168.8.230
-mesh_globals:
-  primary: netbird
-  accepted:
-  - netbird
-  - tailscale
-notes:
- Reads /opt/homelab-context/ on startup
-age_pubkey: age1xmkeq968areza2necqyq0065dpeegngzyr6dhagh0n6pl33lccfqe5mqn9
-see_also:
- containers/123-claudio-bot.md
-mcp_endpoint: https://mcp.hubris.network/mcp
-secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/elementsynapse.yaml
+++ b/hosts/elementsynapse.yaml
@@ -7,15 +7,11 @@ os: linux
 role: matrix-server
 host: hubris
 pve_id: 118
-lan_ip: 192.168.8.239 # static; was DHCP drifting to .244 — fixed by setting iface eth0 inet static
-mesh:
-  tailscale:
-    fqdn: elementsynapse
+lan_ip: 192.168.8.239
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 public_host: matrix.hubris.network
 runs:
 - matrix
--- a/hosts/gitea.yaml
+++ b/hosts/gitea.yaml
@@ -8,14 +8,10 @@ role: git-server
 host: hubris
 pve_id: 104
 lan_ip: 192.168.8.121
-mesh:
-  tailscale:
-    fqdn: gitea
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: git.hubris.network
--- a/hosts/haos.yaml
+++ b/hosts/haos.yaml
@@ -8,14 +8,10 @@ role: home-automation
 host: hubris
 pve_id: 108
 lan_ip: 192.168.8.101
-mesh:
-  tailscale:
-    fqdn: homeassistant
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 runs:
 - haos
 services_hosted:
--- a/hosts/hubris.yaml
+++ b/hosts/hubris.yaml
@@ -14,7 +14,6 @@ mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library
 ssh:
--- a/hosts/jellyfin.yaml
+++ b/hosts/jellyfin.yaml
@@ -8,14 +8,10 @@ role: media-server
 host: hubris
 pve_id: 101
 lan_ip: 192.168.8.206
-mesh:
-  tailscale:
-    fqdn: jellyfin
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: media.hubris.network
--- a/hosts/ludo-mini.yaml
+++ b/hosts/ludo-mini.yaml
@@ -5,6 +5,7 @@ name: ludo-mini
 kind: workstation
 os: linux
 role: dev
+lan_ip: 192.168.178.181
 mesh:
  netbird:
    fqdn: ludo-mini.netbird.selfhosted
@@ -12,6 +13,7 @@ mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
+ssh:
+  user: dtoro
 mcp_endpoint: https://mcp.hubris.network/mcp
 secrets_issuance_endpoint: https://secrets.hubris.network/issue
--- a/hosts/mac-mini.yaml
+++ b/hosts/mac-mini.yaml
@@ -5,7 +5,7 @@ name: mac-mini
 kind: workstation
 os: macos
 role: dev
-lan_ip: 192.168.8.174
+lan_ip: 192.168.178.182
 mesh:
  netbird:
    fqdn: mac-mini-234-17.netbird.selfhosted
@@ -13,7 +13,6 @@ mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 ssh:
  user: dtoro
 notes:
--- a/hosts/mule-images.yaml
+++ b/hosts/mule-images.yaml
@@ -8,14 +8,10 @@ role: photo-management
 host: hubris
 pve_id: 120
 lan_ip: 192.168.8.136
-mesh:
-  tailscale:
-    fqdn: muleimage
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: photos.hubris.network
--- a/hosts/netbird-vps.yaml
+++ b/hosts/netbird-vps.yaml
@@ -13,7 +13,6 @@ mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 ssh:
  user: root
 notes:
--- a/hosts/nextcloud.yaml
+++ b/hosts/nextcloud.yaml
@@ -8,14 +8,10 @@ role: file-sync
 host: hubris
 pve_id: 114
 lan_ip: 192.168.8.224
-mesh:
-  tailscale:
-    fqdn: nextcloud
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: cloud.hubris.network
--- a/hosts/nfs-export.yaml
+++ b/hosts/nfs-export.yaml
@@ -12,7 +12,6 @@ mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 see_also:
 - containers/102-nfs-export.md
 mcp_endpoint: https://mcp.hubris.network/mcp
--- a/hosts/paperless.yaml
+++ b/hosts/paperless.yaml
@@ -8,14 +8,10 @@ role: document-archive
 host: hubris
 pve_id: 103
 lan_ip: 192.168.8.130
-mesh:
-  tailscale:
-    fqdn: paperless
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library
 public_host: paperless.hubris.network
--- a/hosts/plato.yaml
+++ b/hosts/plato.yaml
@@ -12,7 +12,6 @@ mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library/documents/plato
 public_host: plato.hubris.network
--- a/hosts/republic-laptop.yaml
+++ b/hosts/republic-laptop.yaml
@@ -12,7 +12,6 @@ mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 ssh:
  user: dtoro
 mcp_endpoint: https://mcp.hubris.network/mcp
--- a/hosts/sophia.yaml
+++ b/hosts/sophia.yaml
@@ -8,14 +8,10 @@ role: workshop
 host: hubris
 pve_id: 119
 lan_ip: 192.168.8.109
-mesh:
-  tailscale:
-    fqdn: sophia
 mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 mounts:
 - /mnt/library
 see_also:
--- a/hosts/zimaos.yaml
+++ b/hosts/zimaos.yaml
@@ -12,7 +12,6 @@ mesh_globals:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
 public_host: zimaos.hubris.network
 runs:
 - zimaos
--- a/infrastructure/dns.md
+++ b/infrastructure/dns.md
@@ -9,7 +9,7 @@ There is **no wildcard on the LAN side**. Every subdomain needs an explicit entr
 - **Authoritative public DNS:** IONOS. `*.hubris.network → 82.165.190.79` (was `74.118.126.4` until 2026-04-22).
 - **LAN authoritative for `hubris.network` records:** [Technitium DNS](https://technitium.com) on [dns (107)](../containers/107-dns.md) at `192.168.8.2:53`. Syncs A records to the NetBird managed DNS zone via cron (see [dns-sync.py](../scripts/dns-sync.py)). Formerly dnsmasq on [authentik (124)](../containers/124-authentik.md) (decommissioned 2026-06-04).
 - **PVE host** (`192.168.8.77`): resolver is the local Netbird daemon at `100.122.38.109:53`, which forwards to the LAN/upstream and learns hubris.network answers via that path. `netbird status` says "Nameservers: 0/0 Available" — confirming netbird does NOT manage a hubris.network zone; it just caches whatever the system resolver returns.
- **Some LXCs** keep router DNS (`192.168.8.1`) or Tailscale MagicDNS (`100.100.100.100`), both of which return the public IONOS A record. Those LXCs need either a `/etc/hosts` override or local dnsmasq — see [mesh migration](mesh.md) for which technique applies where.
+- **All LXCs** now point at Technitium (`192.168.8.2`) directly (since 2026-06-21 — see changelog). The earlier mix of router DNS (`192.168.8.1`) / Tailscale MagicDNS (`100.100.100.100`) — which returned the public IONOS A record and forced `/etc/hosts` overrides — has been removed.

 ## Live entries (as of 2026-06-04)

@@ -76,6 +76,18 @@ Either:

 ## Changelog

+### 2026-06-21 — DNS single-source, Phase 1: on-prem LXCs decoupled from NetBird
+Goal: collapse the three overlapping DNS sources (Technitium + NetBird managed zone + per-LXC band-aids) toward **one zone**, keeping NetBird. Phase 1 (the safe, mesh-independent half) is done:
+
+- **Every homelab LXC now resolves via Technitium (`192.168.8.2`).** Fixed 8 boxes that were on a dead resolver, the router, or Tailscale MagicDNS:
+  - `192.168.8.180` (dead ex-Authentik): 102, 106, 126
+  - `192.168.8.1` (router → public answer): 101
+  - `100.100.100.100` (Tailscale MagicDNS): 104, 105, 114, 119 — also ran `tailscale set --accept-dns=false` so `tailscaled` stops rewriting `/etc/resolv.conf`.
+  - Already correct (`.2`): 103, 118, 120, 121, 122. CT 107 stays on `1.1.1.1` by design (no self-dependency).
+- **Removed the redundant `/etc/hosts` band-aids** (`auth`/`mcp`/`secrets` → `192.168.8.175`) on 101, 103, 104, 105, 114, 118, 120, 121, 122, 126; disabled `hubris-hosts-override.service` where enabled. Backups at `/etc/hosts.bak-dnsplan`. PVE-managed lines and self-hostname maps preserved. Technitium already returns identical-or-better answers (verified: `auth → 82.165.190.79`, `mcp`/`secrets`/`cloud`/`git` → `192.168.8.175`).
+- **Nextcloud (114):** its documented Guzzle-workaround dnsmasq is not running; resolves correctly straight from Technitium, so no special-casing remains.
+- Net effect: **NetBird's DNS now only matters for off-LAN roaming peers** (Tier 2). On-prem (LXCs + household via Fritz!Box→Technitium) is fully NetBird-independent — so dropping the managed zone later can no longer break on-LAN resolution. Phases 2–4 (mesh-IP forwarding, roaming test, managed-zone + sync deletion) still pending.
+
 ### 2026-06-17 — Fritz!Box DNSv4 server set to Technitium; old limitation resolved
 Household LAN clients (192.168.178.x) now resolve `*.hubris.network` to LAN IPs — the limitation noted below is resolved. Configured at Fritz!Box Internet → Filter → DNS Server → DNSv4 Server = `192.168.8.2` (User-defined).
 Authentik LXC 124 (192.168.8.180) destroyed — Authentik runs on VPS, DNS on Technitium (107).
--- a/infrastructure/homelab-context.md
+++ b/infrastructure/homelab-context.md
@@ -64,9 +64,11 @@ The MCP server and secrets-issuance each have their own clone

 - Both services bind `0.0.0.0:<port>`. The trust boundary is
  `MESH_SUBNETS` in the service's environment + nftables (planned). Today
-  `MESH_SUBNETS=100.122.0.0/16,100.64.0.0/10,192.168.8.0/24` — Netbird +
-  Tailscale + the homelab LAN. Adjust if the LAN ever has untrusted
-  devices.
+  `MESH_SUBNETS=100.122.0.0/16,192.168.8.0/24` — Netbird + the homelab LAN.
+  (The legacy Tailscale CGNAT range `100.64.0.0/10` was dropped 2026-06-21
+  when Tailscale was decommissioned; secrets-issuance restarted. Only
+  secrets-issuance reads `MESH_SUBNETS` — homelab-mcp does not.) Adjust if
+  the LAN ever has untrusted devices.
 - Caddy fronts both with Let's Encrypt certs via the IONOS DNS challenge:
  `mcp.hubris.network` → `192.168.8.205:9810`,
  `secrets.hubris.network` → `192.168.8.205:9820`. Off-LAN clients on
@@ -125,7 +127,7 @@ The MCP server and secrets-issuance each have their own clone
  step-by-step for adding a new client
 - [Auto-deploy](auto-deploy.md) — the `homelab-mcp` + `secrets-issuance`
  pipelines (and the rest of the lab's webhook pipelines)
- [Mesh](mesh.md) — Netbird / Tailscale paths and the `192.168.8.0/24`
+- [Mesh](mesh.md) — Netbird paths and the `192.168.8.0/24`
  network resource
 - [Apps (105)](../containers/105-apps.md) — where both services run
 - [Gitea (104)](../containers/104-gitea.md) — the source of truth
--- a/infrastructure/mesh.md
+++ b/infrastructure/mesh.md
@@ -1,12 +1,12 @@
-# Mesh — Tailscale → Netbird migration
+# Mesh — Netbird

-The hubris fleet is migrating from Tailscale to Netbird. Netbird is the target end-state. In-progress as of 2026-04-21.
+The hubris fleet runs on Netbird. Tailscale — the previous overlay — was **fully decommissioned on 2026-06-21**: removed from the 6 LXCs that still ran it (101, 103, 104, 105, 114, 119), apt package + state purged, `tailscaled` disabled. The fleet is now Netbird-only. (Historical migration notes below are kept for context.)

 ## Current state

 - **PVE host** uses Netbird (`wt0`, `100.122.38.109/16`). Its resolver is the local netbird daemon, which forwards to LAN/upstream — so the PVE host gets `*.hubris.network → 192.168.8.175` via the system resolver chain.
 - **Netbird mgmt host** (`82.165.190.79`, FQDN `inspiring-ramanujan.netbird.selfhosted`, NB IP `100.122.165.149`) is now itself a peer on the mesh (joined 2026-04-22 via setup key, netbird 0.69.0). Routes the homelab network (`192.168.8.0/24`) via the PVE peer. This gives the mgmt host LAN access *and* split-horizon DNS for `*.hubris.network`. Useful independently of any Authentik integration.
- **Most LXCs** still run Tailscale or use router DNS (`192.168.8.1`) / Tailscale MagicDNS (`100.100.100.100`), both of which return the *public* IONOS A record `*.hubris.network → 82.165.190.79`. The VPS only routes hostnames it actually publishes (today, `artifacto` + `blog`), so this path is a dead end for any LAN-only service.
+- **All LXCs** now resolve via Technitium (`192.168.8.2`) directly — as of the 2026-06-21 DNS single-source work (Phase 1). The previous mix of router DNS (`192.168.8.1`) / Tailscale MagicDNS (`100.100.100.100`) returned the *public* IONOS A record and is gone. See [dns.md changelog 2026-06-21](dns.md).

 ## ICE / STUN / TURN

@@ -45,6 +45,8 @@ Pre-migration, the bundled `netbirdio/netbird-server` combined image silently ig

 ## Consequence — every LXC wired to Authentik needs an internal override

+> **RESOLVED 2026-06-21 (DNS single-source, Phase 1).** Every homelab LXC now points its resolver directly at **Technitium (`192.168.8.2`)**, which answers the full split-horizon zone (`auth → 82.165.190.79`, everything else → Caddy `192.168.8.175`). The per-LXC `/etc/hosts` overrides and Tailscale-MagicDNS/dead-`.180`/router resolvers below were removed; `hubris-hosts-override.service` disabled where present. The section is kept for history. See [dns.md changelog 2026-06-21](dns.md).
+
 Until each LXC is migrated to Netbird, anything that needs to reach `auth.hubris.network` (Authentik), `cloud.hubris.network` (Nextcloud), etc., must override the public answer with `192.168.8.175`.

 Two techniques. Pick by HTTP-client behavior.
@@ -90,7 +92,7 @@ pct set <id> --nameserver "127.0.0.1 192.168.8.1 1.1.1.1"
 ## Adding new LXCs

 - Don't add new LXCs to Tailscale; add them to Netbird. Tailscale is being decommissioned on hubris.
- When wiring a new app into Authentik: `cat /etc/resolv.conf` on the target LXC. If nameserver is `192.168.8.1` or `100.100.100.100`, add the hosts override. If it's the netbird daemon IP, skip.
+- When wiring a new app into Authentik: `cat /etc/resolv.conf` on the target LXC. It should be `192.168.8.2` (Technitium), which returns correct split-horizon answers — no `/etc/hosts` override needed. (Historically, boxes on `192.168.8.1`/`100.100.100.100` needed an override; those resolvers were removed 2026-06-21.)

 ## Long-term fix

--- a/infrastructure/network.md
+++ b/infrastructure/network.md
@@ -64,14 +64,14 @@ No NAT on Proxmox — traffic flows without double-NAT.

 ## Remote access

- **NetBird mesh** — primary path for remote administration. Authenticated via [Authentik on the VPS](../vps/).
- **Tailscale** — legacy, being phased out. See [mesh.md](mesh.md).
+- **NetBird mesh** — the remote-administration path. Authenticated via [Authentik on the VPS](../vps/).
+- Tailscale (the previous overlay) was **decommissioned 2026-06-21**. See [mesh.md](mesh.md).

 ## Related

 - [DNS](dns.md) — split-horizon config and entry list
 - [Ingress](ingress.md) — public entry points via VPS traefik
- [Mesh](mesh.md) — NetBird / Tailscale VPN overlay
+- [Mesh](mesh.md) — NetBird VPN overlay
 - [hosts/hubris.md](../hosts/hubris.md) — Proxmox host (vmbr0/vmbr1 config)
 - [CT 107 — dns](../containers/107-dns.md) — Technitium DNS + DHCP server

--- a/inventory.yaml
+++ b/inventory.yaml
@@ -11,8 +11,8 @@
 #     ("external" is reserved for hosts the homelab CLI manages via ssh but
 #      that aren't homelab clients themselves — e.g. the IONOS netbird VPS
 #      with no /etc/age/key.txt and no /opt/homelab-context clone.)
-#   - `mesh:` lists addresses the host is reachable at. Both `netbird` and
-#     `tailscale` are accepted during the migration (see infrastructure/mesh.md).
+#   - `mesh:` lists addresses the host is reachable at via `netbird`.
+#     (Tailscale was decommissioned 2026-06-21 — see infrastructure/mesh.md.)
 #     Prefer netbird FQDNs over raw IPs.
 #   - `age_pubkey:` provisioned by secrets-issuance on first bootstrap and
 #     committed back via `homelab client add --finalize-pubkey <key>`.
@@ -32,7 +32,6 @@ mesh:
  primary: netbird
  accepted:
  - netbird
-  - tailscale
  netbird_subnet: 100.122.0.0/16
  netbird_domain: netbird.selfhosted
 services:
@@ -125,9 +124,6 @@ hosts:
    role: media-server
    lan_ip: 192.168.8.206
    public_host: media.hubris.network
-    mesh:
-      tailscale:
-        fqdn: jellyfin
    mounts:
    - /mnt/library
    age_pubkey: ''
@@ -146,9 +142,6 @@ hosts:
    role: document-archive
    lan_ip: 192.168.8.130
    public_host: paperless.hubris.network
-    mesh:
-      tailscale:
-        fqdn: paperless
    mounts:
    - /mnt/library
    age_pubkey: ''
@@ -161,9 +154,6 @@ hosts:
    lan_ip: 192.168.8.121
    public_host: git.hubris.network
    backend_port: 3000
-    mesh:
-      tailscale:
-        fqdn: gitea
    mounts:
    - /mnt/library
    notes:
@@ -178,10 +168,6 @@ hosts:
    lan_ip: 192.168.8.205
    public_hosts:
    - artifacto.hubris.network
-    mesh:
-      tailscale:
-        ip: 100.121.171.122
-        fqdn: apps
    mounts:
    - /mnt/library
    runs:
@@ -198,9 +184,6 @@ hosts:
    role: file-sync
    lan_ip: 192.168.8.224
    public_host: cloud.hubris.network
-    mesh:
-      tailscale:
-        fqdn: nextcloud
    mounts:
    - /mnt/library
    age_pubkey: ''
@@ -212,9 +195,6 @@ hosts:
    role: matrix-server
    lan_ip: 192.168.8.239
    public_host: matrix.hubris.network
-    mesh:
-      tailscale:
-        fqdn: elementsynapse
  sophia:
    kind: lxc
    pve_id: 119
@@ -222,9 +202,6 @@ hosts:
    os: linux
    role: workshop
    lan_ip: 192.168.8.109
-    mesh:
-      tailscale:
-        fqdn: sophia
    mounts:
    - /mnt/library
    age_pubkey: ''
@@ -236,9 +213,6 @@ hosts:
    role: photo-management
    lan_ip: 192.168.8.136
    public_host: photos.hubris.network
-    mesh:
-      tailscale:
-        fqdn: muleimage
    mounts:
    - /mnt/library
    age_pubkey: ''
@@ -266,9 +240,6 @@ hosts:
    - jellyseerr.hubris.network
    - qbit.hubris.network
    - sab.hubris.network
-    mesh:
-      tailscale:
-        fqdn: arr
    mounts:
    - /mnt/library
    age_pubkey: ''
@@ -299,9 +270,6 @@ hosts:
    os: linux
    role: home-automation
    lan_ip: 192.168.8.101
-    mesh:
-      tailscale:
-        fqdn: homeassistant
  republic-laptop:
    kind: workstation
    os: linux
--- a/operations/agent-enrollment.md
+++ b/operations/agent-enrollment.md
@@ -18,7 +18,7 @@ operational reference is here.
 | --- | --- | --- |
 | Hostname matches an entry in `inventory.yaml` | The bootstrap looks up `hosts/$(hostname).yaml`. | `hostname` (Linux) / `scutil --get LocalHostName` (macOS) |
 | OS is Linux or macOS | bootstrap detects via `uname -s` | `uname -s` |
-| On the mesh (Netbird or Tailscale) **or** on the LAN | issuance is gated to mesh + LAN subnets. **For Netbird: use a setup-key, not interactive auth** — see "Getting onto Netbird" below. | `netbird status` / `tailscale status` |
+| On the Netbird mesh **or** on the LAN | issuance is gated to mesh + LAN subnets. **For Netbird: use a setup-key, not interactive auth** — see "Getting onto Netbird" below. | `netbird status` |
 | `git`, `python3`, `python3-yaml`, `age`, `sops` | bootstrap preflight; `homelab` CLI imports yaml | See per-OS commands below |
 | Can resolve `*.hubris.network` | bootstrap calls `https://secrets.hubris.network/issue` and writes `https://mcp.hubris.network/mcp` | `dig +short mcp.hubris.network` (should return `192.168.8.175`) |