36a686d953
Audit against actual netbird+tailscale peer lists:
- hubris is the only LXC-host on Netbird; only workstations + hubris
have netbird entries
- 10 LXCs+VMs have real Tailscale FQDNs: apps, jellyfin, paperless,
gitea, nextcloud, elementsynapse, sophia, mule-images→muleimage,
arriman→arr, haos→homeassistant
- 7 hosts are LAN-only (no mesh block): nfs-export, caddy, claudio-bot,
authentik, plato, mule-photos-new, zimaos
- mac-mini's netbird FQDN corrected to the actual peer name
(mac-mini-234-17.netbird.selfhosted)
Also: bin/homelab host_address() now prefers lan_ip first — universally
reachable from any LAN client and from any Netbird peer via the
192.168.8.0/24 network resource routed through hubris. Mesh FQDNs are
fallbacks for roaming workstations without a fixed lan_ip.
This makes 'homelab status' from republic show all backends 'ok' instead
of falsely reporting them 'down' against unresolvable netbird FQDNs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
33 lines
797 B
YAML
33 lines
797 B
YAML
# Generated by mcp/build_host_files.py from inventory.yaml.
|
|
# Do NOT edit by hand — your changes will be overwritten.
|
|
# Source of truth: ../inventory.yaml
|
|
name: authentik
|
|
kind: lxc
|
|
os: linux
|
|
role: idp
|
|
host: hubris
|
|
pve_id: 124
|
|
lan_ip: 192.168.8.180
|
|
mesh_globals:
|
|
primary: netbird
|
|
accepted:
|
|
- netbird
|
|
- tailscale
|
|
public_host: auth.hubris.network
|
|
runs:
|
|
- authentik
|
|
- dnsmasq
|
|
services_hosted:
|
|
- name: authentik
|
|
url: https://auth.hubris.network
|
|
backend: authentik
|
|
- name: dnsmasq
|
|
backend: authentik
|
|
note: split-horizon DNS, /etc/dnsmasq.d/hubris-split.conf
|
|
notes:
|
|
- 'Also hosts split-horizon dnsmasq: /etc/dnsmasq.d/hubris-split.conf'
|
|
see_also:
|
|
- containers/124-authentik.md
|
|
mcp_endpoint: https://mcp.hubris.network/sse
|
|
secrets_issuance_endpoint: https://secrets.hubris.network/issue
|