dtoro
41de395240
hosts/hubris.md: - Update At a glance network section: vmbr1 uplink (192.168.178.10), vmbr0 portless internal bridge with 192.168.8.1 alias - Remove Phase 1 WiFi failover section (wlp3s0 disabled 2026-06-02) - Changelog: Slate AX retired, SODOLA added, Proxmox as subnet router containers/121-caddy.md: - Changelog: caddy.service unit was missing from hubris1 package, recreated manually; risk of loss on package reinstall noted containers/107-dns.md: - Update Who points here: Technitium DHCP hands out .2 as DNS for homelab clients; Fritz!Box LAN clients still get Fritz!Box DNS - Add DHCP section documenting the homelab scope (100-240, gw .1) - Changelog: DHCP enabled 2026-06-02, replaces Slate AX DHCP Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
54 lines
3.7 KiB
Markdown
54 lines
3.7 KiB
Markdown
# 107 — `dns`
|
||
|
||
Homelab DNS server (Technitium). Replaces the dnsmasq that lived on [124 — authentik](124-authentik.md); single-purpose, one job.
|
||
|
||
## At a glance
|
||
- **Hostname:** `dns`
|
||
- **IP:** `192.168.8.2` (static — stable, decoupled from any app)
|
||
- **Privilege:** privileged (Docker-in-LXC, `features: nesting=1`)
|
||
- **Resources:** 1 core / 1 GiB / 8 GiB rootfs
|
||
- **Created:** 2026-06-01, Debian 13. Its own resolver is `1.1.1.1` (no circular dependency on the DNS it serves).
|
||
|
||
## Role
|
||
Authoritative split-horizon DNS for `hubris.network` on the LAN/mesh, plus recursive forwarding (`1.1.1.1`, `8.8.8.8`) for everything else. Technitium runs in Docker (`technitium/dns-server:latest`, `network_mode: host`), web console on `:5380`.
|
||
|
||
## The `hubris.network` zone
|
||
- Specific A overrides: app names → `192.168.8.175` (Caddy), `nfs-export → 192.168.8.200`, `auth/sso/...` as needed.
|
||
- `auth.hubris.network → 82.165.190.79` (VPS Authentik), `sso.hubris.network → 192.168.8.175` (LAN forward-auth outpost).
|
||
- **Wildcard** `*.hubris.network → 82.165.190.79` — mirrors the public IONOS wildcard so undefined names (e.g. `netbird`) resolve to the VPS, matching public behaviour.
|
||
- **MX / SPF-TXT / CAA replicated from public** so an authoritative zone doesn't shadow `hubris.network` email/cert records.
|
||
|
||
## Config / access
|
||
- `/opt/technitium/docker-compose.yml`; admin password in `/opt/technitium/admin_password.txt` (mode 600 — sops-encrypt in Phase 5).
|
||
- Console: `http://192.168.8.2:5380` (user `admin`).
|
||
- API: `http://192.168.8.2:5380/api/...` (token via `/api/user/login`). Zone was built via the API.
|
||
|
||
## Who points here
|
||
- **NetBird mesh peers:** nameserver group `home-lab-dns` (`hubris.network` → this server). *Note: the [NetBird managed DNS zone](124-authentik.md) still answers most app names directly, bypassing this — see the single-source-of-truth decision.*
|
||
- **Homelab DHCP clients:** Technitium's own DHCP scope hands out `192.168.8.2` as the DNS server for `192.168.8.x` leases (see DHCP section below).
|
||
- **Plain LAN clients (`192.168.178.x`):** Fritz!Box DHCP still hands out Fritz!Box itself (`192.168.178.1`) as DNS — no split-horizon for non-mesh clients. Changing this requires a secondary DNS fallback, which Fritz!OS 8.x doesn't expose in a single DHCP field.
|
||
- **Secondary:** Mac Mini (planned, Phase 3) via AXFR zone transfer.
|
||
|
||
## DHCP
|
||
|
||
Technitium also runs a DHCP server for the homelab subnet (enabled 2026-06-02):
|
||
- **Scope:** `homelab` — `192.168.8.100 – 192.168.8.240`
|
||
- **Gateway:** `192.168.8.1` (Proxmox `vmbr0` alias)
|
||
- **DNS:** `192.168.8.2` (self)
|
||
- **Lease time:** 24 h
|
||
|
||
Replaces the DHCP that was previously served by the Slate AX router. Static-IP LXCs (below `.100`) are unaffected.
|
||
|
||
## Related
|
||
- [124 — authentik](124-authentik.md) — retired host of the old dnsmasq
|
||
- [DNS split-horizon](../infrastructure/dns.md)
|
||
- [Mesh](../infrastructure/mesh.md)
|
||
|
||
## Changelog
|
||
|
||
### 2026-06-02 — DHCP server enabled; replaces Slate AX DHCP
|
||
Enabled Technitium's built-in DHCP server for `192.168.8.0/24` (scope `homelab`, range `.100–.240`, gateway `192.168.8.1`, DNS self). Previously the Slate AX sub-router served DHCP for the homelab subnet. With the Slate AX retired and Proxmox now the subnet router, Technitium takes over DHCP. Configured via the Technitium API (`/api/dhcp/scopes/set`). DHCP LXCs kept their Slate AX leases until expiry, then renewed from Technitium.
|
||
|
||
### 2026-06-01 — created; replaced dnsmasq on 124
|
||
Stood up Technitium at `192.168.8.2`, imported the split-horizon zone (specific A + wildcard + MX/SPF/CAA), made it the primary nameserver in the NetBird `home-lab-dns` group. Verified all names resolve with dnsmasq/124 stopped; [LXC 124 retired](124-authentik.md).
|