Archived
beatzaplentyandClaude Sonnet 4.6
89cc8c8cc3
Installs and documents the FreeIPA identity management server at domain-controller.sweet.home (VMID 108, pve1). Provides Kerberos, LDAP, and integrated DNS for the SWEET.HOME realm. New section: freeipa/ - docs/install.md: full step-by-step reproduction procedure including Proxmox VM prep (Rocky Linux 9 GenericCloud, SeaBIOS, cloud-init), swap setup, static IP, /etc/hosts fix, ipa-server-install flags - docs/pihole-dns.md: how to configure Pi-hole to forward sweet.home queries to the FreeIPA BIND instance - scripts/install.sh: idempotent install script with pre-flight checks; reads passwords from env or interactive prompt (never commits them) - scripts/configure-pihole-dns.sh: idempotent Pi-hole forwarder setup - scripts/verify.sh: read-only health check (13 checks, 0 side effects) - CLAUDE.md: host guardrails for domain-controller Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Jbvxx4xbHVcx1NkK3vtmK
71 lines
2.2 KiB
Markdown
71 lines
2.2 KiB
Markdown
# Pi-hole DNS forwarding for sweet.home
|
|
|
|
FreeIPA's BIND instance is the authoritative DNS server for the
|
|
`sweet.home` zone. Pi-hole (at `192.168.2.253`) is the LAN resolver
|
|
for everything else. To make Kerberos, LDAP, and host lookups work
|
|
from all LAN clients, Pi-hole must forward `sweet.home` queries to
|
|
the domain-controller.
|
|
|
|
## What needs configuring
|
|
|
|
One dnsmasq directive on Pi-hole:
|
|
|
|
```
|
|
server=/sweet.home/192.168.2.138
|
|
```
|
|
|
|
This makes Pi-hole forward every `*.sweet.home` query (and the bare
|
|
`sweet.home` zone) to `192.168.2.138` (domain-controller) instead
|
|
of its upstream resolver.
|
|
|
|
## How to apply
|
|
|
|
Use `scripts/configure-pihole-dns.sh` for an automated, idempotent
|
|
application, or apply manually as below.
|
|
|
|
### Manual — Pi-hole v6 (TOML config)
|
|
|
|
Pi-hole v6 reads custom dnsmasq options from:
|
|
```
|
|
/etc/pihole/pihole.toml → dns.customDnsEntries
|
|
```
|
|
or from drop-in files in `/etc/dnsmasq.d/`. The drop-in approach
|
|
is more robust across upgrades:
|
|
|
|
```bash
|
|
ssh <pihole-host>
|
|
echo 'server=/sweet.home/192.168.2.138' \
|
|
| sudo tee /etc/dnsmasq.d/10-ipa-sweet-home.conf
|
|
sudo pihole restartdns
|
|
```
|
|
|
|
Verify:
|
|
```bash
|
|
dig +short _kerberos._udp.sweet.home SRV @192.168.2.253
|
|
# Should return: 0 100 88 domain-controller.sweet.home.
|
|
dig +short domain-controller.sweet.home A @192.168.2.253
|
|
# Should return: 192.168.2.138
|
|
```
|
|
|
|
## Why this is required
|
|
|
|
FreeIPA clients use DNS SRV records to discover the KDC, LDAP server,
|
|
and other IPA services. Without the forwarder, Pi-hole returns NXDOMAIN
|
|
for `_kerberos._udp.sweet.home` and `_ldap._tcp.sweet.home`, which
|
|
causes `kinit` and IPA client enrollment to fail — even if the IP
|
|
address is reachable.
|
|
|
|
## Records IPA publishes
|
|
|
|
Once forwarding is set up, Pi-hole clients will be able to resolve:
|
|
|
|
| Record | Type | Value |
|
|
|--------|------|-------|
|
|
| `domain-controller.sweet.home` | A | `192.168.2.138` |
|
|
| `_kerberos._udp.sweet.home` | SRV | `0 100 88 domain-controller.sweet.home` |
|
|
| `_kerberos._tcp.sweet.home` | SRV | `0 100 88 domain-controller.sweet.home` |
|
|
| `_ldap._tcp.sweet.home` | SRV | `0 100 389 domain-controller.sweet.home` |
|
|
| `_kpasswd._udp.sweet.home` | SRV | `0 100 464 domain-controller.sweet.home` |
|
|
| `_kerberos.sweet.home` | TXT | `"SWEET.HOME"` |
|
|
| `ipa-ca.sweet.home` | A | `192.168.2.138` |
|