From b71402aaeda54620c5804eae9aa0980c149f7d1b Mon Sep 17 00:00:00 2001
From: dtoro <d.toro.v@pm.me>
Date: Mon, 22 Jun 2026 09:31:04 +0200
Subject: [PATCH] add auth-outpost (106) and dns (107) to inventory +
 regenerate host files

---
 hosts/auth-outpost.yaml   | 21 +++++++++++++++++++++
 hosts/dns.yaml            | 30 ++++++++++++++++++++++++++++++
 hosts/elementsynapse.yaml |  2 +-
 inventory.yaml            | 19 +++++++++++++++++++
 4 files changed, 71 insertions(+), 1 deletion(-)
 create mode 100644 hosts/auth-outpost.yaml
 create mode 100644 hosts/dns.yaml

diff --git a/hosts/auth-outpost.yaml b/hosts/auth-outpost.yaml
new file mode 100644
index 0000000..93112bf
--- /dev/null
+++ b/hosts/auth-outpost.yaml
@@ -0,0 +1,21 @@
+# Generated by mcp/build_host_files.py from inventory.yaml.
+# Do NOT edit by hand — your changes will be overwritten.
+# Source of truth: ../inventory.yaml
+name: auth-outpost
+kind: lxc
+os: linux
+role: authentik-gateway
+host: hubris
+pve_id: 106
+lan_ip: 192.168.8.6
+mesh_globals:
+  primary: netbird
+  accepted:
+  - netbird
+  - tailscale
+notes:
+- Runs Authentik outpost (reverse-proxy/SSO enforcement) for protected services
+see_also:
+- containers/106-auth-outpost.md
+mcp_endpoint: https://mcp.hubris.network/mcp
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
diff --git a/hosts/dns.yaml b/hosts/dns.yaml
new file mode 100644
index 0000000..8e01807
--- /dev/null
+++ b/hosts/dns.yaml
@@ -0,0 +1,30 @@
+# Generated by mcp/build_host_files.py from inventory.yaml.
+# Do NOT edit by hand — your changes will be overwritten.
+# Source of truth: ../inventory.yaml
+name: dns
+kind: lxc
+os: linux
+role: dns-server
+host: hubris
+pve_id: 107
+lan_ip: 192.168.8.2
+mesh_globals:
+  primary: netbird
+  accepted:
+  - netbird
+  - tailscale
+runs:
+- authentik
+services_hosted:
+- name: authentik
+  url: https://auth.hubris.network
+  backend: dns
+  dns: null
+  note: Technitium DNS, split-horizon zone
+notes:
+- Technitium DNS, split-horizon zone for *.hubris.network
+- Primary DNS for 192.168.8.0/24 LAN (inventory.services.dns references this)
+see_also:
+- containers/107-dns.md
+mcp_endpoint: https://mcp.hubris.network/mcp
+secrets_issuance_endpoint: https://secrets.hubris.network/issue
diff --git a/hosts/elementsynapse.yaml b/hosts/elementsynapse.yaml
index 9630c4f..a162061 100644
--- a/hosts/elementsynapse.yaml
+++ b/hosts/elementsynapse.yaml
@@ -7,7 +7,7 @@ os: linux
 role: matrix-server
 host: hubris
 pve_id: 118
-lan_ip: 192.168.8.239 # static; was DHCP drifting to .244 — fixed by setting iface eth0 inet static
+lan_ip: 192.168.8.239
 mesh:
   tailscale:
     fqdn: elementsynapse
diff --git a/inventory.yaml b/inventory.yaml
index fa560f8..5950e14 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -190,6 +190,25 @@ hosts:
     - homelab-mcp
     - secrets-issuance
     age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
+  auth-outpost:
+    kind: lxc
+    pve_id: 106
+    host: hubris
+    os: linux
+    role: authentik-gateway
+    lan_ip: 192.168.8.6
+    notes:
+    - Runs Authentik outpost (reverse-proxy/SSO enforcement) for protected services
+  dns:
+    kind: lxc
+    pve_id: 107
+    host: hubris
+    os: linux
+    role: dns-server
+    lan_ip: 192.168.8.2
+    notes:
+    - Technitium DNS, split-horizon zone for *.hubris.network
+    - Primary DNS for 192.168.8.0/24 LAN (inventory.services.dns references this)
   nextcloud:
     kind: lxc
     pve_id: 114