Files

dtoro 41de395240 docs: post-migration changelog entries on hubris, caddy, dns

hosts/hubris.md:
- Update At a glance network section: vmbr1 uplink (192.168.178.10),
  vmbr0 portless internal bridge with 192.168.8.1 alias
- Remove Phase 1 WiFi failover section (wlp3s0 disabled 2026-06-02)
- Changelog: Slate AX retired, SODOLA added, Proxmox as subnet router

containers/121-caddy.md:
- Changelog: caddy.service unit was missing from hubris1 package,
  recreated manually; risk of loss on package reinstall noted

containers/107-dns.md:
- Update Who points here: Technitium DHCP hands out .2 as DNS for
  homelab clients; Fritz!Box LAN clients still get Fritz!Box DNS
- Add DHCP section documenting the homelab scope (100-240, gw .1)
- Changelog: DHCP enabled 2026-06-02, replaces Slate AX DHCP

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-02 22:02:34 +02:00

3.7 KiB

Raw Blame History

107 — `dns`

Homelab DNS server (Technitium). Replaces the dnsmasq that lived on 124 — authentik; single-purpose, one job.

At a glance

Hostname: dns
IP: 192.168.8.2 (static — stable, decoupled from any app)
Privilege: privileged (Docker-in-LXC, features: nesting=1)
Resources: 1 core / 1 GiB / 8 GiB rootfs
Created: 2026-06-01, Debian 13. Its own resolver is 1.1.1.1 (no circular dependency on the DNS it serves).

Role

Authoritative split-horizon DNS for hubris.network on the LAN/mesh, plus recursive forwarding (1.1.1.1, 8.8.8.8) for everything else. Technitium runs in Docker (technitium/dns-server:latest, network_mode: host), web console on :5380.

The `hubris.network` zone

Specific A overrides: app names → 192.168.8.175 (Caddy), nfs-export → 192.168.8.200, auth/sso/... as needed.
auth.hubris.network → 82.165.190.79 (VPS Authentik), sso.hubris.network → 192.168.8.175 (LAN forward-auth outpost).
Wildcard *.hubris.network → 82.165.190.79 — mirrors the public IONOS wildcard so undefined names (e.g. netbird) resolve to the VPS, matching public behaviour.
MX / SPF-TXT / CAA replicated from public so an authoritative zone doesn't shadow hubris.network email/cert records.

Config / access

/opt/technitium/docker-compose.yml; admin password in /opt/technitium/admin_password.txt (mode 600 — sops-encrypt in Phase 5).
Console: http://192.168.8.2:5380 (user admin).
API: http://192.168.8.2:5380/api/... (token via /api/user/login). Zone was built via the API.

Who points here

NetBird mesh peers: nameserver group home-lab-dns (hubris.network → this server). Note: the NetBird managed DNS zone still answers most app names directly, bypassing this — see the single-source-of-truth decision.
Homelab DHCP clients: Technitium's own DHCP scope hands out 192.168.8.2 as the DNS server for 192.168.8.x leases (see DHCP section below).
Plain LAN clients (192.168.178.x): Fritz!Box DHCP still hands out Fritz!Box itself (192.168.178.1) as DNS — no split-horizon for non-mesh clients. Changing this requires a secondary DNS fallback, which Fritz!OS 8.x doesn't expose in a single DHCP field.
Secondary: Mac Mini (planned, Phase 3) via AXFR zone transfer.

DHCP

Technitium also runs a DHCP server for the homelab subnet (enabled 2026-06-02):

Scope: homelab — 192.168.8.100 – 192.168.8.240
Gateway: 192.168.8.1 (Proxmox vmbr0 alias)
DNS: 192.168.8.2 (self)
Lease time: 24 h

Replaces the DHCP that was previously served by the Slate AX router. Static-IP LXCs (below .100) are unaffected.

124 — authentik — retired host of the old dnsmasq
DNS split-horizon
Mesh

Changelog

2026-06-02 — DHCP server enabled; replaces Slate AX DHCP

Enabled Technitium's built-in DHCP server for 192.168.8.0/24 (scope homelab, range .100–.240, gateway 192.168.8.1, DNS self). Previously the Slate AX sub-router served DHCP for the homelab subnet. With the Slate AX retired and Proxmox now the subnet router, Technitium takes over DHCP. Configured via the Technitium API (/api/dhcp/scopes/set). DHCP LXCs kept their Slate AX leases until expiry, then renewed from Technitium.

2026-06-01 — created; replaced dnsmasq on 124

Stood up Technitium at 192.168.8.2, imported the split-horizon zone (specific A + wildcard + MX/SPF/CAA), made it the primary nameserver in the NetBird home-lab-dns group. Verified all names resolve with dnsmasq/124 stopped; LXC 124 retired.

3.7 KiB Raw Blame History Unescape Escape

107 — dns