# Pi-hole DNS forwarding for sweet.home

FreeIPA's BIND instance is the authoritative DNS server for the
`sweet.home` zone. Pi-hole (at `192.168.2.253`) is the LAN resolver
for everything else. To make Kerberos, LDAP, and host lookups work
from all LAN clients, Pi-hole must forward `sweet.home` queries to
the domain-controller.

## What needs configuring

One dnsmasq directive on Pi-hole:

```
server=/sweet.home/192.168.2.138
```

This makes Pi-hole forward every `*.sweet.home` query (and the bare
`sweet.home` zone) to `192.168.2.138` (domain-controller) instead
of its upstream resolver.

## How to apply

Use `scripts/configure-pihole-dns.sh` for an automated, idempotent
application, or apply manually as below.

### Manual — Pi-hole v6 (TOML config)

Pi-hole v6 reads custom dnsmasq options from:
```
/etc/pihole/pihole.toml  →  dns.customDnsEntries
```
or from drop-in files in `/etc/dnsmasq.d/`. The drop-in approach
is more robust across upgrades:

```bash
ssh <pihole-host>
echo 'server=/sweet.home/192.168.2.138' \
  | sudo tee /etc/dnsmasq.d/10-ipa-sweet-home.conf
sudo pihole restartdns
```

Verify:
```bash
dig +short _kerberos._udp.sweet.home SRV @192.168.2.253
# Should return: 0 100 88 domain-controller.sweet.home.
dig +short domain-controller.sweet.home A @192.168.2.253
# Should return: 192.168.2.138
```

## Why this is required

FreeIPA clients use DNS SRV records to discover the KDC, LDAP server,
and other IPA services. Without the forwarder, Pi-hole returns NXDOMAIN
for `_kerberos._udp.sweet.home` and `_ldap._tcp.sweet.home`, which
causes `kinit` and IPA client enrollment to fail — even if the IP
address is reachable.

## Records IPA publishes

Once forwarding is set up, Pi-hole clients will be able to resolve:

| Record | Type | Value |
|--------|------|-------|
| `domain-controller.sweet.home` | A | `192.168.2.138` |
| `_kerberos._udp.sweet.home` | SRV | `0 100 88 domain-controller.sweet.home` |
| `_kerberos._tcp.sweet.home` | SRV | `0 100 88 domain-controller.sweet.home` |
| `_ldap._tcp.sweet.home` | SRV | `0 100 389 domain-controller.sweet.home` |
| `_kpasswd._udp.sweet.home` | SRV | `0 100 464 domain-controller.sweet.home` |
| `_kerberos.sweet.home` | TXT | `"SWEET.HOME"` |
| `ipa-ca.sweet.home` | A | `192.168.2.138` |