dtoro
85457095e4
Phase 1 of the DNS-redundancy cleanup (keep NetBird, collapse toward one zone) — the safe, mesh-independent half: - Every homelab LXC now resolves via Technitium (192.168.8.2). Fixed 8 boxes on a dead resolver (.180), the router (.1), or Tailscale MagicDNS (100.100.100.100): 101,102,104,105,106,114,119,126. - Removed the redundant /etc/hosts auth/mcp/secrets overrides (Technitium returns identical-or-better answers); disabled hubris-hosts-override. - Net effect: on-prem DNS (LXCs + household via Fritz!Box->Technitium) is now NetBird-independent, so dropping the managed zone later can't break on-LAN resolution. Phases 2-4 still pending. Tailscale decommissioned (was legacy/being-phased-out): - Removed from the 6 LXCs still running it (101,103,104,105,114,119): logout, disable tailscaled, apt purge, state cleared. - inventory.yaml: dropped tailscale from accepted + all mesh blocks; regenerated hosts/*.yaml (also pruned orphan authentik/claudio-bot). - Tightened secrets-issuance MESH_SUBNETS: removed the now-vestigial Tailscale CGNAT range 100.64.0.0/10. - Updated narrative docs (mesh, dns, network, README, AGENTS, agent-enrollment, homelab-context, 105-apps, 107-dns). Live infra changed on the fleet + Mac; this commit records the docs/inventory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
# Generated by mcp/build_host_files.py from inventory.yaml.
|
|
# Do NOT edit by hand — your changes will be overwritten.
|
|
# Source of truth: ../inventory.yaml
|
|
name: netbird-vps
|
|
kind: external
|
|
os: linux
|
|
role: netbird-mgmt
|
|
mesh:
|
|
netbird:
|
|
ip: 100.122.165.149
|
|
fqdn: netbird-ionos.netbird.selfhosted
|
|
mesh_globals:
|
|
primary: netbird
|
|
accepted:
|
|
- netbird
|
|
ssh:
|
|
user: root
|
|
notes:
|
|
- "Public IONOS VPS \u2014 hosts the vanilla netbird mgmt+signal+relay+dashboard stack + host coturn (see\
|
|
\ infrastructure/vps-hardening.md + infrastructure/mesh.md changelog 2026-05-21)."
|
|
- NOT a homelab client. No /etc/age/key.txt, no /opt/homelab-context clone. Managed via ssh from hubris;
|
|
sshd is locked to hubris's pubkey.
|
|
- Public IPv4 82.165.190.79. Auto-patching via unattended-upgrades.
|
|
- Configs rendered by `homelab render-vps-configs` from vps/turnserver.conf.tmpl + vps/management.json.tmpl,
|
|
with secrets decrypted from secrets/turn-shared-secret.yaml + secrets/netbird-authentik-oidc.yaml on
|
|
hubris.
|
|
mcp_endpoint: https://mcp.hubris.network/mcp
|
|
secrets_issuance_endpoint: https://secrets.hubris.network/issue
|