diff --git a/containers/107-dns.md b/containers/107-dns.md index de81ddc..6418283 100644 --- a/containers/107-dns.md +++ b/containers/107-dns.md @@ -24,12 +24,14 @@ Authoritative split-horizon DNS for `hubris.network` on the LAN/mesh, plus recur - API: `http://192.168.8.2:5380/api/...` (token via `/api/user/login`). Zone was built via the API. ## Who points here -- **NetBird mesh peers:** resolve via the **NetBird managed DNS zone**, kept in sync *from* this Technitium (see dns-sync below). The `home-lab-dns` nameserver group (`→ 192.168.8.2`) is a thin fallback forwarder. +- **NetBird mesh peers:** resolve `hubris.network` via the `home-lab-dns` nameserver group (`→ 192.168.8.2`, applied to all peers) — now that roaming peers (`Core`) have the `192.168.8.0/24` route (fixed 2026-06-21), this forwarding path works for everyone. The **NetBird managed DNS zone** (kept in sync from this Technitium via dns-sync below) is now a redundant fallback, slated for removal in Phase 4. - **Homelab DHCP clients:** Technitium's own DHCP scope hands out `192.168.8.2` as the DNS server for `192.168.8.x` leases (see DHCP section below). - **Plain LAN clients (`192.168.178.x`):** Fritz!Box DHCP still hands out Fritz!Box itself (`192.168.178.1`) as DNS, **but** the Fritz!Box now *forwards* upstream to Technitium — DNSv4 server set to `192.168.8.2` (Internet → Filter → DNS Server, 2026-06-17). So household clients get split-horizon `*.hubris.network` answers via Fritz!Box→Technitium, with **no NetBird dependency**. (This is the change that decoupled the on-prem tier from the mesh — see [dns.md](../infrastructure/dns.md) 2026-06-17.) ## dns-sync (Technitium = authoring source) -`/opt/dns-sync/sync.py` (cron `*/10`, logs `/var/log/dns-sync.log`) reconciles this zone's named A-records → the NetBird managed DNS zone via the NetBird API (`/api/dns/zones/{id}/records`). Token at `/opt/dns-sync/netbird-token` (mode 600; source of truth in sops `secrets/netbird-pat.yaml`). **Edit DNS only here**; the sync propagates to the mesh. It deletes NetBird records absent from Technitium. Tracked: [scripts/dns-sync.py](../scripts/dns-sync.py). *Why this exists:* NetBird won't forward to Technitium for mesh peers (self-IP / nameserver-group quirks), so we sync into the managed zone instead — see [dns.md](../infrastructure/dns.md). +`/opt/dns-sync/sync.py` (cron `*/10`, logs `/var/log/dns-sync.log`) reconciles this zone's named A-records → the NetBird managed DNS zone via the NetBird API (`/api/dns/zones/{id}/records`). Token at `/opt/dns-sync/netbird-token` (mode 600; source of truth in sops `secrets/netbird-pat.yaml`). **Edit DNS only here**; the sync propagates to the mesh. It deletes NetBird records absent from Technitium. Tracked: [scripts/dns-sync.py](../scripts/dns-sync.py). + +> **Why this exists (and why it's being retired) — corrected 2026-06-21.** The sync was built on the belief that "NetBird won't forward to Technitium for mesh peers." That was **wrong**: the `home-lab-dns` nameserver group (→ `192.168.8.2`, domain `hubris.network`) was applied to all peers, but the `192.168.8.0/24` route was distributed only to the `Services` group — roaming peers (`Core`) had no route to reach `192.168.8.2`. Adding `Core` to the route distribution fixed forwarding directly. The managed zone + this sync are now redundant and slated for removal in Phase 4. See [dns.md changelog 2026-06-21](../infrastructure/dns.md). ## DHCP diff --git a/infrastructure/dns.md b/infrastructure/dns.md index 90c22c9..59cffca 100644 --- a/infrastructure/dns.md +++ b/infrastructure/dns.md @@ -76,6 +76,16 @@ Either: ## Changelog +### 2026-06-21 — DNS single-source, Phase 2: roaming-peer forwarding fixed (root cause was a missing route, not a NetBird bug) +The long-standing belief that "NetBird won't forward to Technitium for mesh peers" (which is *why* the managed-zone sync was built) turned out to be **wrong**. The NetBird API showed the real cause: + +- The `home-lab-dns` nameserver group (→ `192.168.8.2`, match-domain `hubris.network`) was already applied to **all** peers (via the `All` group). So every peer *had* the forwarding rule. +- But the `192.168.8.0/24` route (network resource `home-lab-network`) was distributed to the **`Services`** group only = `{netbird-ionos, proxmox-server}`. Roaming peers (`dtoro-iphone`, `mac-mini`, `republic-laptop`, `muli-laptop`, `ludo-mini`) are in **`Core`**, which had **no route to the homelab subnet** → they couldn't reach `192.168.8.2` → forwarding silently failed (`Networks: -`). + +**Fix:** added the `Core` group to the `home-lab-network` resource distribution (now `[Services, Core]`) via `PUT /api/networks/.../resources/...`. Roaming peers immediately picked up `Networks: 192.168.8.0/24` and `[192.168.8.2:53] for [hubris.network] is Available`. No CT 107 mesh-join / TUN / restart was needed (the original Phase 2 hypothesis is obsolete). This also gives roaming devices full homelab **service** access, not just DNS. + +The managed zone is still in place as a fallback pending the Phase 3 roaming test (iPhone on cellular); Phase 4 then deletes the managed zone + `dns-sync` cron. Rollback: PUT the resource back to `[Services]` only. + ### 2026-06-21 — DNS single-source, Phase 1: on-prem LXCs decoupled from NetBird Goal: collapse the three overlapping DNS sources (Technitium + NetBird managed zone + per-LXC band-aids) toward **one zone**, keeping NetBird. Phase 1 (the safe, mesh-independent half) is done: