dtoro
f81310ae6b
- scripts/dns-sync.py: reconcile Technitium named A-records -> NetBird managed zone via API (cron */10 on dns LXC 107). Single authoring source; kills the manual drift behind the auth/sso/nfs-export saga. - secrets/netbird-pat.yaml: sops-encrypted NetBird API PAT for the sync. - dns.md / 107-dns.md: document the sync model + why forward-to-Technitium was abandoned (NetBird self-IP / nameserver-group quirks). - Cleanup: removed inert Mac secondary; reverted primary AXFR; home-lab-dns -> [192.168.8.2] (1/1 Available); deleted vestigial Proxmox Names group. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
45 lines
3.5 KiB
Markdown
45 lines
3.5 KiB
Markdown
# 107 — `dns`
|
|
|
|
Homelab DNS server (Technitium). Replaces the dnsmasq that lived on [124 — authentik](124-authentik.md); single-purpose, one job.
|
|
|
|
## At a glance
|
|
- **Hostname:** `dns`
|
|
- **IP:** `192.168.8.2` (static — stable, decoupled from any app)
|
|
- **Privilege:** privileged (Docker-in-LXC, `features: nesting=1`)
|
|
- **Resources:** 1 core / 1 GiB / 8 GiB rootfs
|
|
- **Created:** 2026-06-01, Debian 13. Its own resolver is `1.1.1.1` (no circular dependency on the DNS it serves).
|
|
|
|
## Role
|
|
Authoritative split-horizon DNS for `hubris.network` on the LAN/mesh, plus recursive forwarding (`1.1.1.1`, `8.8.8.8`) for everything else. Technitium runs in Docker (`technitium/dns-server:latest`, `network_mode: host`), web console on `:5380`.
|
|
|
|
## The `hubris.network` zone
|
|
- Specific A overrides: app names → `192.168.8.175` (Caddy), `nfs-export → 192.168.8.200`, `auth/sso/...` as needed.
|
|
- `auth.hubris.network → 82.165.190.79` (VPS Authentik), `sso.hubris.network → 192.168.8.175` (LAN forward-auth outpost).
|
|
- **Wildcard** `*.hubris.network → 82.165.190.79` — mirrors the public IONOS wildcard so undefined names (e.g. `netbird`) resolve to the VPS, matching public behaviour.
|
|
- **MX / SPF-TXT / CAA replicated from public** so an authoritative zone doesn't shadow `hubris.network` email/cert records.
|
|
|
|
## Config / access
|
|
- `/opt/technitium/docker-compose.yml`; admin password in `/opt/technitium/admin_password.txt` (mode 600 — sops-encrypt in Phase 5).
|
|
- Console: `http://192.168.8.2:5380` (user `admin`).
|
|
- API: `http://192.168.8.2:5380/api/...` (token via `/api/user/login`). Zone was built via the API.
|
|
|
|
## Who points here
|
|
- **NetBird mesh peers:** resolve via the **NetBird managed DNS zone**, which is kept in sync *from* this Technitium (see dns-sync below). The `home-lab-dns` nameserver group (`→ 192.168.8.2`) is a thin fallback forwarder.
|
|
- **Plain LAN clients:** router DHCP should hand out `192.168.8.2` (the old `.180`/dnsmasq is gone).
|
|
|
|
## dns-sync (Technitium = authoring source)
|
|
`/opt/dns-sync/sync.py` (cron `*/10`, logs `/var/log/dns-sync.log`) reconciles this zone's named A-records → the NetBird managed DNS zone via the NetBird API (`/api/dns/zones/{id}/records`). Token at `/opt/dns-sync/netbird-token` (mode 600; source of truth in sops `secrets/netbird-pat.yaml`). **Edit DNS only here**; the sync propagates to the mesh. It deletes NetBird records absent from Technitium. Tracked: [scripts/dns-sync.py](../scripts/dns-sync.py). *Why this exists:* NetBird won't forward to Technitium for mesh peers (self-IP / nameserver-group quirks), so we sync into the managed zone instead — see [dns.md](../infrastructure/dns.md).
|
|
|
|
## Related
|
|
- [124 — authentik](124-authentik.md) — retired host of the old dnsmasq
|
|
- [DNS split-horizon](../infrastructure/dns.md)
|
|
- [Mesh](../infrastructure/mesh.md)
|
|
|
|
## Changelog
|
|
|
|
### 2026-06-03 — dns-sync added (Technitium → NetBird managed zone)
|
|
This Technitium became the single DNS authoring source; `/opt/dns-sync/sync.py` (cron */10) reconciles named A-records into the NetBird managed zone via the API. Fixed previously-broken mesh names (`sso`, `nfs-export`, `mcp`, `secrets`) by adding them to the managed zone; reaped obsolete `files`/`photos-new`. See [dns.md](../infrastructure/dns.md).
|
|
|
|
### 2026-06-01 — created; replaced dnsmasq on 124
|
|
Stood up Technitium at `192.168.8.2`, imported the split-horizon zone (specific A + wildcard + MX/SPF/CAA), made it the primary nameserver in the NetBird `home-lab-dns` group. Verified all names resolve with dnsmasq/124 stopped; [LXC 124 retired](124-authentik.md).
|