beatzaplenty/debian-configuration
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(freeipa): update IPs and remove Pi-hole references
Secret Scan / Scan for secrets and sensitive config (push) Failing after 4s
Details
Secret Scan / Scan for secrets and sensitive config (pull_request) Failing after 3s
Details

Browse Source 
- IPA now runs at 192.168.2.253 (previously shown as .138 in install docs)
- cloud-init nameserver and nmcli DNS during install use .254 (gateway)
  since IPA isn't running yet at that point
- --forwarder updated to 192.168.2.254 (LAN gateway, Pi-hole is gone)
- Remove Step 7 (Pi-hole DNS forwarding config) from install.md
- Delete obsolete freeipa/docs/pihole-dns.md and configure-pihole-dns.sh
- Update CLAUDE.md section count and freeipa/ guidance entry
- Update freeipa/README.md IP and DNS forwarding description

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
beatzaplenty
2026-07-28 15:25:22 +10:00
co-authored by Claude Sonnet 4.6
parent 0c15de3329
commit 761fe9e194
5 changed files with 22 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
freeipa/README.md
+3 -16
View File
@@ -9,7 +9,7 @@ Proxmox VM (VMID 108 on `pve1.sweet.home`).
| Item | Value |
|------|-------|
| Host | `domain-controller.sweet.home` |
| IP | `192.168.2.138` (static) |
| IP | `192.168.2.253` (static) |
| Realm | `SWEET.HOME` |
| Domain | `sweet.home` |
| IPA version | 4.13.x (Rocky Linux 9) |
@@ -21,8 +21,8 @@ Proxmox VM (VMID 108 on `pve1.sweet.home`).
- **Kerberos KDC** — SSO tickets for the `SWEET.HOME` realm
- **LDAP directory** — centralised user/group/host store (389-ds)
- **Integrated DNS** — authoritative for `sweet.home`, forwarding
everything else upstream to Pi-hole (`192.168.2.253`)
- **Integrated DNS** — authoritative for `sweet.home` and primary LAN
resolver for all hosts, forwarding everything else to the LAN gateway
- **CA** — self-signed CA issuing certs for IPA services
- **Web UI** — at `https://domain-controller.sweet.home/ipa/ui/`
@@ -60,19 +60,6 @@ kinit admin
ipa passwd admin
```
## DNS integration with Pi-hole
Pi-hole must forward `sweet.home` DNS queries to this server so
that Kerberos SRV records and IPA host records resolve correctly.
Run `scripts/configure-pihole-dns.sh` once, or add the following
to Pi-hole's custom DNS config manually:
```
server=/sweet.home/192.168.2.138
```
See `docs/pihole-dns.md` for the full setup.
## Ports required (firewalld)
FreeIPA's firewalld config is applied by `ipa-server-install` automatically.