docs(freeipa): update IPs and remove Pi-hole references

- IPA now runs at 192.168.2.253 (previously shown as .138 in install docs)
- cloud-init nameserver and nmcli DNS during install use .254 (gateway)
  since IPA isn't running yet at that point
- --forwarder updated to 192.168.2.254 (LAN gateway, Pi-hole is gone)
- Remove Step 7 (Pi-hole DNS forwarding config) from install.md
- Delete obsolete freeipa/docs/pihole-dns.md and configure-pihole-dns.sh
- Update CLAUDE.md section count and freeipa/ guidance entry
- Update freeipa/README.md IP and DNS forwarding description

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -6,8 +6,9 @@ OVERRIDE any default behaviour and must be followed exactly.
 ## Repo purpose
 
 Configuration toolsets and docs for Wayne's Debian-based LAN machines.
-Two sections currently exist: `proxmox/` (Proxmox VE hosts) and
-`pihole/` (Pi-hole DNS/DHCP). Each has its own README.
+Three sections currently exist: `proxmox/` (Proxmox VE hosts),
+`pihole/` (Pi-hole DNS/DHCP), and `freeipa/` (FreeIPA identity
+management). Each has its own README.
 
 ## Safety rules (apply everywhere in this repo)
 
@@ -35,6 +36,10 @@ Two sections currently exist: `proxmox/` (Proxmox VE hosts) and
   rules above. `apply-config.sh` is the only script that touches a live
   host; treat its `<dest-host>` argument as production unless you're
   explicitly testing on a throwaway instance.
+- **FreeIPA:** `freeipa/` documents and scripts for the FreeIPA identity
+  management server (`domain-controller.sweet.home`, VMID 108 on `pve1`).
+  All scripts that SSH into the server are production operations — treat
+  them as off-limits without an explicit same-session go-ahead.
 
 ## Adding a new machine type
 

freeipa/README.md

@@ -9,7 +9,7 @@ Proxmox VM (VMID 108 on `pve1.sweet.home`).
 | Item | Value |
 |------|-------|
 | Host | `domain-controller.sweet.home` |
-| IP | `192.168.2.138` (static) |
+| IP | `192.168.2.253` (static) |
 | Realm | `SWEET.HOME` |
 | Domain | `sweet.home` |
 | IPA version | 4.13.x (Rocky Linux 9) |
@@ -21,8 +21,8 @@ Proxmox VM (VMID 108 on `pve1.sweet.home`).
 
 - **Kerberos KDC** — SSO tickets for the `SWEET.HOME` realm
 - **LDAP directory** — centralised user/group/host store (389-ds)
-- **Integrated DNS** — authoritative for `sweet.home`, forwarding
-  everything else upstream to Pi-hole (`192.168.2.253`)
+- **Integrated DNS** — authoritative for `sweet.home` and primary LAN
+  resolver for all hosts, forwarding everything else to the LAN gateway
 - **CA** — self-signed CA issuing certs for IPA services
 - **Web UI** — at `https://domain-controller.sweet.home/ipa/ui/`
 
@@ -60,19 +60,6 @@ kinit admin
 ipa passwd admin
 ```
 
-## DNS integration with Pi-hole
-
-Pi-hole must forward `sweet.home` DNS queries to this server so
-that Kerberos SRV records and IPA host records resolve correctly.
-Run `scripts/configure-pihole-dns.sh` once, or add the following
-to Pi-hole's custom DNS config manually:
-
-```
-server=/sweet.home/192.168.2.138
-```
-
-See `docs/pihole-dns.md` for the full setup.
-
 ## Ports required (firewalld)
 
 FreeIPA's firewalld config is applied by `ipa-server-install` automatically.

freeipa/docs/install.md

@@ -78,11 +78,13 @@ echo 'ssh-rsa AAAA... wayne@stream' > /tmp/admin-key.pub
 # (use the key from variables.nix adminSshKey)
 
 # Configure cloud-init
+# Use the LAN gateway as temporary DNS — IPA itself will be the DNS at
+# 192.168.2.253, but it's not running yet at this point in the install.
 sudo qm set <VMID> \
   --ciuser wayne \
   --sshkeys /tmp/admin-key.pub \
   --ipconfig0 ip=dhcp \
-  --nameserver 192.168.2.253 \
+  --nameserver 192.168.2.254 \
   --searchdomain sweet.home
 
 # Set boot order
@@ -138,10 +140,13 @@ echo '/swapfile none swap defaults 0 0' | sudo tee -a /etc/fstab
 CON=$(nmcli -t -f NAME con show --active | head -1)
 sudo nmcli con mod "$CON" \
   ipv4.method manual \
-  ipv4.addresses 192.168.2.138/24 \
+  ipv4.addresses 192.168.2.253/24 \
   ipv4.gateway 192.168.2.254 \
-  ipv4.dns 192.168.2.253 \
+  ipv4.dns 192.168.2.254 \
   ipv4.dns-search sweet.home
+# Note: using the gateway as DNS here — after IPA installs it becomes the
+# authoritative resolver at 192.168.2.253. Clients should then point to
+# 192.168.2.253 for sweet.home resolution.
 sudo nmcli con up "$CON"
 ```
 
@@ -149,7 +154,7 @@ sudo nmcli con up "$CON"
 
 ```bash
 sudo sed -i '/domain-controller/d' /etc/hosts
-echo '192.168.2.138 domain-controller.sweet.home domain-controller' \
+echo '192.168.2.253 domain-controller.sweet.home domain-controller' \
   | sudo tee -a /etc/hosts
 
 # Prevent cloud-init from resetting this on reboot
@@ -192,7 +197,7 @@ sudo ipa-server-install \
   --ds-password="$DM_PASS" \
   --admin-password="$ADMIN_PASS" \
   --setup-dns \
-  --forwarder=192.168.2.253 \
+  --forwarder=192.168.2.254 \
   --no-dnssec-validation \
   --no-ntp \
   --unattended
@@ -200,7 +205,7 @@ sudo ipa-server-install \
 
 Key flags:
 - `--setup-dns` — install BIND as IPA's authoritative DNS for `sweet.home`
-- `--forwarder=192.168.2.253` — forward non-sweet.home queries to Pi-hole
+- `--forwarder=192.168.2.254` — forward non-sweet.home queries to the LAN gateway
 - `--no-dnssec-validation` — skip DNSSEC (home lab has no DNSSEC chain)
 - `--no-ntp` — Proxmox handles time sync for guests; don't install chrony
 
@@ -223,18 +228,7 @@ dig +short _kerberos._udp.sweet.home SRV @127.0.0.1
 
 ---
 
-## Step 7 — Configure Pi-hole to forward sweet.home DNS
-
-See `docs/pihole-dns.md` and `scripts/configure-pihole-dns.sh`.
-
-The short version — add to Pi-hole's custom dnsmasq config:
-```
-server=/sweet.home/192.168.2.138
-```
-
----
-
-## Step 8 — Back up the CA certificate
+## Step 7 — Back up the CA certificate
 
 ```bash
 # On domain-controller (encrypted with Directory Manager password)

freeipa/docs/pihole-dns.md

@@ -1,70 +0,0 @@
-# Pi-hole DNS forwarding for sweet.home
-
-FreeIPA's BIND instance is the authoritative DNS server for the
-`sweet.home` zone. Pi-hole (at `192.168.2.253`) is the LAN resolver
-for everything else. To make Kerberos, LDAP, and host lookups work
-from all LAN clients, Pi-hole must forward `sweet.home` queries to
-the domain-controller.
-
-## What needs configuring
-
-One dnsmasq directive on Pi-hole:
-
-```
-server=/sweet.home/192.168.2.138
-```
-
-This makes Pi-hole forward every `*.sweet.home` query (and the bare
-`sweet.home` zone) to `192.168.2.138` (domain-controller) instead
-of its upstream resolver.
-
-## How to apply
-
-Use `scripts/configure-pihole-dns.sh` for an automated, idempotent
-application, or apply manually as below.
-
-### Manual — Pi-hole v6 (TOML config)
-
-Pi-hole v6 reads custom dnsmasq options from:
-```
-/etc/pihole/pihole.toml  →  dns.customDnsEntries
-```
-or from drop-in files in `/etc/dnsmasq.d/`. The drop-in approach
-is more robust across upgrades:
-
-```bash
-ssh <pihole-host>
-echo 'server=/sweet.home/192.168.2.138' \
-  | sudo tee /etc/dnsmasq.d/10-ipa-sweet-home.conf
-sudo pihole restartdns
-```
-
-Verify:
-```bash
-dig +short _kerberos._udp.sweet.home SRV @192.168.2.253
-# Should return: 0 100 88 domain-controller.sweet.home.
-dig +short domain-controller.sweet.home A @192.168.2.253
-# Should return: 192.168.2.138
-```
-
-## Why this is required
-
-FreeIPA clients use DNS SRV records to discover the KDC, LDAP server,
-and other IPA services. Without the forwarder, Pi-hole returns NXDOMAIN
-for `_kerberos._udp.sweet.home` and `_ldap._tcp.sweet.home`, which
-causes `kinit` and IPA client enrollment to fail — even if the IP
-address is reachable.
-
-## Records IPA publishes
-
-Once forwarding is set up, Pi-hole clients will be able to resolve:
-
-| Record | Type | Value |
-|--------|------|-------|
-| `domain-controller.sweet.home` | A | `192.168.2.138` |
-| `_kerberos._udp.sweet.home` | SRV | `0 100 88 domain-controller.sweet.home` |
-| `_kerberos._tcp.sweet.home` | SRV | `0 100 88 domain-controller.sweet.home` |
-| `_ldap._tcp.sweet.home` | SRV | `0 100 389 domain-controller.sweet.home` |
-| `_kpasswd._udp.sweet.home` | SRV | `0 100 464 domain-controller.sweet.home` |
-| `_kerberos.sweet.home` | TXT | `"SWEET.HOME"` |
-| `ipa-ca.sweet.home` | A | `192.168.2.138` |

freeipa/scripts/configure-pihole-dns.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-# Configure Pi-hole to forward sweet.home DNS queries to FreeIPA.
-#
-# Usage:
-#   bash configure-pihole-dns.sh <pihole-host>
-#   bash configure-pihole-dns.sh pihole.sweet.home
-#
-# Idempotent — safe to run multiple times.
-# Requires SSH access to the Pi-hole host as a user with sudo.
-
-set -euo pipefail
-
-PIHOLE_HOST="${1:-}"
-IPA_IP="192.168.2.138"
-IPA_DOMAIN="sweet.home"
-DNSMASQ_CONF="/etc/dnsmasq.d/10-ipa-${IPA_DOMAIN//./-}.conf"
-DIRECTIVE="server=/${IPA_DOMAIN}/${IPA_IP}"
-
-if [[ -z "$PIHOLE_HOST" ]]; then
-  echo "Usage: $0 <pihole-host>" >&2
-  exit 1
-fi
-
-echo "==> Configuring Pi-hole at $PIHOLE_HOST to forward $IPA_DOMAIN → $IPA_IP..."
-
-ssh "$PIHOLE_HOST" "
-  set -euo pipefail
-
-  if grep -qF '${DIRECTIVE}' '${DNSMASQ_CONF}' 2>/dev/null; then
-    echo '==> Forwarder already configured, skipping write.'
-  else
-    echo '${DIRECTIVE}' | sudo tee '${DNSMASQ_CONF}'
-    echo '==> Written to ${DNSMASQ_CONF}'
-  fi
-
-  echo '==> Restarting Pi-hole DNS...'
-  sudo pihole restartdns
-
-  echo '==> Verifying SRV record resolution via Pi-hole...'
-  sleep 2
-  dig +short _kerberos._udp.${IPA_DOMAIN} SRV @127.0.0.1 || true
-"
-
-echo "==> Done. Pi-hole now forwards ${IPA_DOMAIN} queries to ${IPA_IP}."
-echo "    Verify from a LAN client:"
-echo "      dig +short _kerberos._udp.${IPA_DOMAIN} SRV @${PIHOLE_HOST}"

proxmox/scripts/bootstrap.sh

@@ -65,3 +65,9 @@ fi
 echo "  - ${SCRIPT_DIR}/create-admin-user.sh <username>   (PVE web UI account)"
 echo "  - Enable 2FA/TOTP for that user and root@pam via the web UI"
 echo "  - ${SCRIPT_DIR}/audit.sh   (verify everything above)"
+echo
+echo "  If this host will be enrolled in FreeIPA:"
+echo "    ipa-client-install --domain=sweet.home --realm=SWEET.HOME \\"
+echo "      --server=domain-controller.sweet.home --mkhomedir --ssh-trust-dns --no-ntp"
+echo "    ${SCRIPT_DIR}/setup-ipa-sudo.sh         (NOPASSWD sudo for IPA admins group)"
+echo "    ${SCRIPT_DIR}/create-local-backdoor.sh <ssh-pubkey>  (emergency local account)"

proxmox/scripts/create-local-backdoor.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+# Create a local 'pveadmin' account as an emergency backdoor for when
+# IPA/SSSD is unavailable. The account authenticates by SSH key only
+# (password auth is disabled by harden-ssh.sh); the password set here
+# is for physical console access only.
+#
+# Idempotent - safe to re-run. If the account already exists, the SSH key
+# is refreshed but the password and account are left unchanged. Run as root.
+#
+# Usage:
+#   ./create-local-backdoor.sh <ssh-public-key>
+#   ./create-local-backdoor.sh --key-file <path-to-.pub>
+#
+# Set BACKDOOR_PASS env var to supply the console password non-interactively;
+# otherwise you will be prompted.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+USERNAME="pveadmin"
+
+SSH_KEY=""
+if [ "${1:-}" = "--key-file" ]; then
+    KEY_FILE="${2:-}"
+    [ -z "$KEY_FILE" ] && { echo "ERROR: --key-file requires a path." >&2; exit 1; }
+    [ -f "$KEY_FILE" ] || { echo "ERROR: key file not found: $KEY_FILE" >&2; exit 1; }
+    SSH_KEY="$(cat "$KEY_FILE")"
+else
+    SSH_KEY="${1:-}"
+fi
+
+if [ -z "$SSH_KEY" ]; then
+    echo "Usage: $0 <ssh-public-key>" >&2
+    echo "       $0 --key-file <path-to-.pub>" >&2
+    exit 1
+fi
+
+if ! echo "$SSH_KEY" | grep -qE '^(ssh-rsa|ssh-ed25519|ecdsa-sha2-nistp[0-9]+) [A-Za-z0-9+/=]'; then
+    echo "ERROR: argument doesn't look like a valid SSH public key." >&2
+    exit 1
+fi
+
+if id "$USERNAME" >/dev/null 2>&1; then
+    echo "User '${USERNAME}' already exists -- not modifying account or password."
+else
+    useradd --create-home --shell /bin/bash "$USERNAME"
+    echo "Created Linux user '${USERNAME}'."
+
+    if [ -n "${BACKDOOR_PASS:-}" ]; then
+        printf '%s:%s\n' "$USERNAME" "$BACKDOOR_PASS" | chpasswd
+        echo "Console password set."
+    else
+        echo "Set a console password for '${USERNAME}' (used for physical console access only):"
+        passwd "$USERNAME"
+    fi
+fi
+
+HOME_DIR="$(getent passwd "$USERNAME" | cut -d: -f6)"
+SSH_DIR="${HOME_DIR}/.ssh"
+AUTH_FILE="${SSH_DIR}/authorized_keys"
+
+mkdir -p "$SSH_DIR"
+chmod 700 "$SSH_DIR"
+chown "${USERNAME}:${USERNAME}" "$SSH_DIR"
+
+if grep -qF "$SSH_KEY" "$AUTH_FILE" 2>/dev/null; then
+    echo "SSH key already present in ${AUTH_FILE}."
+else
+    printf '%s\n' "$SSH_KEY" >> "$AUTH_FILE"
+    echo "Installed SSH key in ${AUTH_FILE}."
+fi
+chmod 600 "$AUTH_FILE"
+chown "${USERNAME}:${USERNAME}" "$AUTH_FILE"
+
+SUDOERS_FILE="/etc/sudoers.d/${USERNAME}-nopasswd"
+write_if_changed "$SUDOERS_FILE" "${USERNAME} ALL=(root) NOPASSWD: ALL"
+chmod 0440 "$SUDOERS_FILE"
+visudo -c >/dev/null
+echo "Sudoers rule for '${USERNAME}' is valid."
+echo
+echo "'${USERNAME}' is ready: SSH key login, NOPASSWD sudo, console password set."

proxmox/scripts/setup-ipa-sudo.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# Grant the IPA 'admins' group passwordless sudo on this host.
+#
+# Writes two files:
+#   /etc/sudoers.d/admins-nopasswd  -- NOPASSWD: ALL for general shell use
+#   /etc/sudoers.d/admins-proxmox   -- NOPASSWD for pvesh/qm/pct (PVE only;
+#                                      skipped silently if those binaries
+#                                      aren't present, e.g. on PBS/PDM)
+#
+# Idempotent - safe to re-run. Run as root on the target host after
+# ipa-client-install has been completed and SSSD is active.
+#
+# Usage: ./setup-ipa-sudo.sh
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+if [ ! -f /etc/ipa/default.conf ]; then
+    echo "ERROR: /etc/ipa/default.conf not found -- is this host enrolled in FreeIPA?" >&2
+    exit 1
+fi
+
+write_if_changed /etc/sudoers.d/admins-nopasswd '%admins ALL=(root) NOPASSWD: ALL'
+chmod 0440 /etc/sudoers.d/admins-nopasswd
+
+# PVE-specific tools -- pvesh moved from /usr/sbin to /usr/bin in PVE 8.x;
+# resolve at script time so the path in the sudoers rule is always correct.
+PVESH="$(command -v pvesh 2>/dev/null || true)"
+QM="$(command -v qm 2>/dev/null || true)"
+PCT="$(command -v pct 2>/dev/null || true)"
+
+if [ -n "$PVESH" ] && [ -n "$QM" ] && [ -n "$PCT" ]; then
+    write_if_changed /etc/sudoers.d/admins-proxmox \
+        "%admins ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}"
+    chmod 0440 /etc/sudoers.d/admins-proxmox
+    echo "Proxmox tools found -- wrote admins-proxmox."
+else
+    echo "pvesh/qm/pct not found -- skipping admins-proxmox (not a PVE host)."
+fi
+
+visudo -c >/dev/null
+echo "All sudoers files valid. IPA admins group has sudo on this host."