add auth-outpost (106) and dns (107) to inventory + regenerate host files

hosts/auth-outpost.yaml

@@ -0,0 +1,21 @@
+# Generated by mcp/build_host_files.py from inventory.yaml.
+# Do NOT edit by hand — your changes will be overwritten.
+# Source of truth: ../inventory.yaml
+name: auth-outpost
+kind: lxc
+os: linux
+role: authentik-gateway
+host: hubris
+pve_id: 106
+lan_ip: 192.168.8.6
+mesh_globals:
+  primary: netbird
+  accepted:
+  - netbird
+  - tailscale
+notes:
+- Runs Authentik outpost (reverse-proxy/SSO enforcement) for protected services
+see_also:
+- containers/106-auth-outpost.md
+mcp_endpoint: https://mcp.hubris.network/mcp
+secrets_issuance_endpoint: https://secrets.hubris.network/issue

hosts/dns.yaml

@@ -0,0 +1,30 @@
+# Generated by mcp/build_host_files.py from inventory.yaml.
+# Do NOT edit by hand — your changes will be overwritten.
+# Source of truth: ../inventory.yaml
+name: dns
+kind: lxc
+os: linux
+role: dns-server
+host: hubris
+pve_id: 107
+lan_ip: 192.168.8.2
+mesh_globals:
+  primary: netbird
+  accepted:
+  - netbird
+  - tailscale
+runs:
+- authentik
+services_hosted:
+- name: authentik
+  url: https://auth.hubris.network
+  backend: dns
+  dns: null
+  note: Technitium DNS, split-horizon zone
+notes:
+- Technitium DNS, split-horizon zone for *.hubris.network
+- Primary DNS for 192.168.8.0/24 LAN (inventory.services.dns references this)
+see_also:
+- containers/107-dns.md
+mcp_endpoint: https://mcp.hubris.network/mcp
+secrets_issuance_endpoint: https://secrets.hubris.network/issue

hosts/elementsynapse.yaml

@@ -7,7 +7,7 @@ os: linux
 role: matrix-server
 host: hubris
 pve_id: 118
-lan_ip: 192.168.8.239 # static; was DHCP drifting to .244 — fixed by setting iface eth0 inet static
+lan_ip: 192.168.8.239
 mesh:
   tailscale:
     fqdn: elementsynapse

inventory.yaml

@@ -190,6 +190,25 @@ hosts:
     - homelab-mcp
     - secrets-issuance
     age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
+  auth-outpost:
+    kind: lxc
+    pve_id: 106
+    host: hubris
+    os: linux
+    role: authentik-gateway
+    lan_ip: 192.168.8.6
+    notes:
+    - Runs Authentik outpost (reverse-proxy/SSO enforcement) for protected services
+  dns:
+    kind: lxc
+    pve_id: 107
+    host: hubris
+    os: linux
+    role: dns-server
+    lan_ip: 192.168.8.2
+    notes:
+    - Technitium DNS, split-horizon zone for *.hubris.network
+    - Primary DNS for 192.168.8.0/24 LAN (inventory.services.dns references this)
   nextcloud:
     kind: lxc
     pve_id: 114