Archived

This repository has been archived on 2026-08-17. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

beatzaplentyandClaude Sonnet 4.6 761fe9e194

Secret Scan / Scan for secrets and sensitive config (push) Failing after 4s

Details

Secret Scan / Scan for secrets and sensitive config (pull_request) Failing after 3s

Details

docs(freeipa): update IPs and remove Pi-hole references

- IPA now runs at 192.168.2.253 (previously shown as .138 in install docs)
- cloud-init nameserver and nmcli DNS during install use .254 (gateway)
  since IPA isn't running yet at that point
- --forwarder updated to 192.168.2.254 (LAN gateway, Pi-hole is gone)
- Remove Step 7 (Pi-hole DNS forwarding config) from install.md
- Delete obsolete freeipa/docs/pihole-dns.md and configure-pihole-dns.sh
- Update CLAUDE.md section count and freeipa/ guidance entry
- Update freeipa/README.md IP and DNS forwarding description

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 15:25:22 +10:00

2.4 KiB

Raw Permalink Blame History

FreeIPA — domain-controller.sweet.home

FreeIPA 4.x identity management server providing Kerberos, LDAP, and integrated DNS for the sweet.home LAN. Runs on Rocky Linux 9 in a Proxmox VM (VMID 108 on pve1.sweet.home).

Quick status

Item	Value
Host	`domain-controller.sweet.home`
IP	`192.168.2.253` (static)
Realm	`SWEET.HOME`
Domain	`sweet.home`
IPA version	4.13.x (Rocky Linux 9)
Web UI	`https://domain-controller.sweet.home/ipa/ui/`
VMID	108 on `pve1.sweet.home`
OS	Rocky Linux 9 (GenericCloud image)

What it provides

Kerberos KDC — SSO tickets for the SWEET.HOME realm
LDAP directory — centralised user/group/host store (389-ds)
Integrated DNS — authoritative for sweet.home and primary LAN resolver for all hosts, forwarding everything else to the LAN gateway
CA — self-signed CA issuing certs for IPA services
Web UI — at https://domain-controller.sweet.home/ipa/ui/

First-time use

# SSH to the server
ssh wayne@domain-controller

# Get a Kerberos ticket as admin
kinit admin

# List IPA users
ipa user-find

# Add a user
ipa user-add jdoe --first=John --last=Doe --password

# Check service health
ipactl status

Credentials

The admin Kerberos password and Directory Manager password were generated at install time. They are not stored in this repo — keep them in your password manager.

admin — used for day-to-day IPA management (kinit admin)
Directory Manager — low-level LDAP root, rarely needed

To reset the admin password (requires being logged in as admin):

kinit admin
ipa passwd admin

Ports required (firewalld)

FreeIPA's firewalld config is applied by ipa-server-install automatically. The following ports must be reachable from LAN clients:

Port	Proto	Service
80	TCP	HTTP (redirect to HTTPS)
443	TCP	HTTPS / Web UI
389	TCP	LDAP
636	TCP	LDAPS
88	TCP+UDP	Kerberos
464	TCP+UDP	Kerberos password change
53	TCP+UDP	DNS

Reproducing this setup

See docs/install.md for the full step-by-step install procedure, or run scripts/install.sh on a fresh Rocky Linux 9 VM with the correct hostname and IP already set.

Backup

The CA certificates (required for replicas) are at /root/cacert.p12 on the server, encrypted with the Directory Manager password. Back these up to a secure location.

2.4 KiB Raw Permalink Blame History