beatzaplentyandClaude Sonnet 4.6
89cc8c8cc3
Installs and documents the FreeIPA identity management server at domain-controller.sweet.home (VMID 108, pve1). Provides Kerberos, LDAP, and integrated DNS for the SWEET.HOME realm. New section: freeipa/ - docs/install.md: full step-by-step reproduction procedure including Proxmox VM prep (Rocky Linux 9 GenericCloud, SeaBIOS, cloud-init), swap setup, static IP, /etc/hosts fix, ipa-server-install flags - docs/pihole-dns.md: how to configure Pi-hole to forward sweet.home queries to the FreeIPA BIND instance - scripts/install.sh: idempotent install script with pre-flight checks; reads passwords from env or interactive prompt (never commits them) - scripts/configure-pihole-dns.sh: idempotent Pi-hole forwarder setup - scripts/verify.sh: read-only health check (13 checks, 0 side effects) - CLAUDE.md: host guardrails for domain-controller Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Jbvxx4xbHVcx1NkK3vtmK
2.2 KiB
Pi-hole DNS forwarding for sweet.home
FreeIPA's BIND instance is the authoritative DNS server for the
sweet.home zone. Pi-hole (at 192.168.2.253) is the LAN resolver
for everything else. To make Kerberos, LDAP, and host lookups work
from all LAN clients, Pi-hole must forward sweet.home queries to
the domain-controller.
What needs configuring
One dnsmasq directive on Pi-hole:
server=/sweet.home/192.168.2.138
This makes Pi-hole forward every *.sweet.home query (and the bare
sweet.home zone) to 192.168.2.138 (domain-controller) instead
of its upstream resolver.
How to apply
Use scripts/configure-pihole-dns.sh for an automated, idempotent
application, or apply manually as below.
Manual — Pi-hole v6 (TOML config)
Pi-hole v6 reads custom dnsmasq options from:
/etc/pihole/pihole.toml → dns.customDnsEntries
or from drop-in files in /etc/dnsmasq.d/. The drop-in approach
is more robust across upgrades:
ssh <pihole-host>
echo 'server=/sweet.home/192.168.2.138' \
| sudo tee /etc/dnsmasq.d/10-ipa-sweet-home.conf
sudo pihole restartdns
Verify:
dig +short _kerberos._udp.sweet.home SRV @192.168.2.253
# Should return: 0 100 88 domain-controller.sweet.home.
dig +short domain-controller.sweet.home A @192.168.2.253
# Should return: 192.168.2.138
Why this is required
FreeIPA clients use DNS SRV records to discover the KDC, LDAP server,
and other IPA services. Without the forwarder, Pi-hole returns NXDOMAIN
for _kerberos._udp.sweet.home and _ldap._tcp.sweet.home, which
causes kinit and IPA client enrollment to fail — even if the IP
address is reachable.
Records IPA publishes
Once forwarding is set up, Pi-hole clients will be able to resolve:
| Record | Type | Value |
|---|---|---|
domain-controller.sweet.home |
A | 192.168.2.138 |
_kerberos._udp.sweet.home |
SRV | 0 100 88 domain-controller.sweet.home |
_kerberos._tcp.sweet.home |
SRV | 0 100 88 domain-controller.sweet.home |
_ldap._tcp.sweet.home |
SRV | 0 100 389 domain-controller.sweet.home |
_kpasswd._udp.sweet.home |
SRV | 0 100 464 domain-controller.sweet.home |
_kerberos.sweet.home |
TXT | "SWEET.HOME" |
ipa-ca.sweet.home |
A | 192.168.2.138 |