docs(freeipa): update IPs and remove Pi-hole references

- IPA now runs at 192.168.2.253 (previously shown as .138 in install docs)
- cloud-init nameserver and nmcli DNS during install use .254 (gateway)
  since IPA isn't running yet at that point
- --forwarder updated to 192.168.2.254 (LAN gateway, Pi-hole is gone)
- Remove Step 7 (Pi-hole DNS forwarding config) from install.md
- Delete obsolete freeipa/docs/pihole-dns.md and configure-pihole-dns.sh
- Update CLAUDE.md section count and freeipa/ guidance entry
- Update freeipa/README.md IP and DNS forwarding description

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

freeipa/docs/install.md

@@ -78,11 +78,13 @@ echo 'ssh-rsa AAAA... wayne@stream' > /tmp/admin-key.pub
 # (use the key from variables.nix adminSshKey)
 
 # Configure cloud-init
+# Use the LAN gateway as temporary DNS — IPA itself will be the DNS at
+# 192.168.2.253, but it's not running yet at this point in the install.
 sudo qm set <VMID> \
   --ciuser wayne \
   --sshkeys /tmp/admin-key.pub \
   --ipconfig0 ip=dhcp \
-  --nameserver 192.168.2.253 \
+  --nameserver 192.168.2.254 \
   --searchdomain sweet.home
 
 # Set boot order
@@ -138,10 +140,13 @@ echo '/swapfile none swap defaults 0 0' | sudo tee -a /etc/fstab
 CON=$(nmcli -t -f NAME con show --active | head -1)
 sudo nmcli con mod "$CON" \
   ipv4.method manual \
-  ipv4.addresses 192.168.2.138/24 \
+  ipv4.addresses 192.168.2.253/24 \
   ipv4.gateway 192.168.2.254 \
-  ipv4.dns 192.168.2.253 \
+  ipv4.dns 192.168.2.254 \
   ipv4.dns-search sweet.home
+# Note: using the gateway as DNS here — after IPA installs it becomes the
+# authoritative resolver at 192.168.2.253. Clients should then point to
+# 192.168.2.253 for sweet.home resolution.
 sudo nmcli con up "$CON"
 ```
 
@@ -149,7 +154,7 @@ sudo nmcli con up "$CON"
 
 ```bash
 sudo sed -i '/domain-controller/d' /etc/hosts
-echo '192.168.2.138 domain-controller.sweet.home domain-controller' \
+echo '192.168.2.253 domain-controller.sweet.home domain-controller' \
   | sudo tee -a /etc/hosts
 
 # Prevent cloud-init from resetting this on reboot
@@ -192,7 +197,7 @@ sudo ipa-server-install \
   --ds-password="$DM_PASS" \
   --admin-password="$ADMIN_PASS" \
   --setup-dns \
-  --forwarder=192.168.2.253 \
+  --forwarder=192.168.2.254 \
   --no-dnssec-validation \
   --no-ntp \
   --unattended
@@ -200,7 +205,7 @@ sudo ipa-server-install \
 
 Key flags:
 - `--setup-dns` — install BIND as IPA's authoritative DNS for `sweet.home`
-- `--forwarder=192.168.2.253` — forward non-sweet.home queries to Pi-hole
+- `--forwarder=192.168.2.254` — forward non-sweet.home queries to the LAN gateway
 - `--no-dnssec-validation` — skip DNSSEC (home lab has no DNSSEC chain)
 - `--no-ntp` — Proxmox handles time sync for guests; don't install chrony
 
@@ -223,18 +228,7 @@ dig +short _kerberos._udp.sweet.home SRV @127.0.0.1
 
 ---
 
-## Step 7 — Configure Pi-hole to forward sweet.home DNS
-
-See `docs/pihole-dns.md` and `scripts/configure-pihole-dns.sh`.
-
-The short version — add to Pi-hole's custom dnsmasq config:
-```
-server=/sweet.home/192.168.2.138
-```
-
----
-
-## Step 8 — Back up the CA certificate
+## Step 7 — Back up the CA certificate
 
 ```bash
 # On domain-controller (encrypted with Directory Manager password)

freeipa/docs/pihole-dns.md

@@ -1,70 +0,0 @@
-# Pi-hole DNS forwarding for sweet.home
-
-FreeIPA's BIND instance is the authoritative DNS server for the
-`sweet.home` zone. Pi-hole (at `192.168.2.253`) is the LAN resolver
-for everything else. To make Kerberos, LDAP, and host lookups work
-from all LAN clients, Pi-hole must forward `sweet.home` queries to
-the domain-controller.
-
-## What needs configuring
-
-One dnsmasq directive on Pi-hole:
-
-```
-server=/sweet.home/192.168.2.138
-```
-
-This makes Pi-hole forward every `*.sweet.home` query (and the bare
-`sweet.home` zone) to `192.168.2.138` (domain-controller) instead
-of its upstream resolver.
-
-## How to apply
-
-Use `scripts/configure-pihole-dns.sh` for an automated, idempotent
-application, or apply manually as below.
-
-### Manual — Pi-hole v6 (TOML config)
-
-Pi-hole v6 reads custom dnsmasq options from:
-```
-/etc/pihole/pihole.toml  →  dns.customDnsEntries
-```
-or from drop-in files in `/etc/dnsmasq.d/`. The drop-in approach
-is more robust across upgrades:
-
-```bash
-ssh <pihole-host>
-echo 'server=/sweet.home/192.168.2.138' \
-  | sudo tee /etc/dnsmasq.d/10-ipa-sweet-home.conf
-sudo pihole restartdns
-```
-
-Verify:
-```bash
-dig +short _kerberos._udp.sweet.home SRV @192.168.2.253
-# Should return: 0 100 88 domain-controller.sweet.home.
-dig +short domain-controller.sweet.home A @192.168.2.253
-# Should return: 192.168.2.138
-```
-
-## Why this is required
-
-FreeIPA clients use DNS SRV records to discover the KDC, LDAP server,
-and other IPA services. Without the forwarder, Pi-hole returns NXDOMAIN
-for `_kerberos._udp.sweet.home` and `_ldap._tcp.sweet.home`, which
-causes `kinit` and IPA client enrollment to fail — even if the IP
-address is reachable.
-
-## Records IPA publishes
-
-Once forwarding is set up, Pi-hole clients will be able to resolve:
-
-| Record | Type | Value |
-|--------|------|-------|
-| `domain-controller.sweet.home` | A | `192.168.2.138` |
-| `_kerberos._udp.sweet.home` | SRV | `0 100 88 domain-controller.sweet.home` |
-| `_kerberos._tcp.sweet.home` | SRV | `0 100 88 domain-controller.sweet.home` |
-| `_ldap._tcp.sweet.home` | SRV | `0 100 389 domain-controller.sweet.home` |
-| `_kpasswd._udp.sweet.home` | SRV | `0 100 464 domain-controller.sweet.home` |
-| `_kerberos.sweet.home` | TXT | `"SWEET.HOME"` |
-| `ipa-ca.sweet.home` | A | `192.168.2.138` |