Archived
beatzaplentyandClaude Sonnet 4.6
89cc8c8cc3
Installs and documents the FreeIPA identity management server at domain-controller.sweet.home (VMID 108, pve1). Provides Kerberos, LDAP, and integrated DNS for the SWEET.HOME realm. New section: freeipa/ - docs/install.md: full step-by-step reproduction procedure including Proxmox VM prep (Rocky Linux 9 GenericCloud, SeaBIOS, cloud-init), swap setup, static IP, /etc/hosts fix, ipa-server-install flags - docs/pihole-dns.md: how to configure Pi-hole to forward sweet.home queries to the FreeIPA BIND instance - scripts/install.sh: idempotent install script with pre-flight checks; reads passwords from env or interactive prompt (never commits them) - scripts/configure-pihole-dns.sh: idempotent Pi-hole forwarder setup - scripts/verify.sh: read-only health check (13 checks, 0 side effects) - CLAUDE.md: host guardrails for domain-controller Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Jbvxx4xbHVcx1NkK3vtmK
47 lines
1.3 KiB
Bash
Executable File
47 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Configure Pi-hole to forward sweet.home DNS queries to FreeIPA.
|
|
#
|
|
# Usage:
|
|
# bash configure-pihole-dns.sh <pihole-host>
|
|
# bash configure-pihole-dns.sh pihole.sweet.home
|
|
#
|
|
# Idempotent — safe to run multiple times.
|
|
# Requires SSH access to the Pi-hole host as a user with sudo.
|
|
|
|
set -euo pipefail
|
|
|
|
PIHOLE_HOST="${1:-}"
|
|
IPA_IP="192.168.2.138"
|
|
IPA_DOMAIN="sweet.home"
|
|
DNSMASQ_CONF="/etc/dnsmasq.d/10-ipa-${IPA_DOMAIN//./-}.conf"
|
|
DIRECTIVE="server=/${IPA_DOMAIN}/${IPA_IP}"
|
|
|
|
if [[ -z "$PIHOLE_HOST" ]]; then
|
|
echo "Usage: $0 <pihole-host>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "==> Configuring Pi-hole at $PIHOLE_HOST to forward $IPA_DOMAIN → $IPA_IP..."
|
|
|
|
ssh "$PIHOLE_HOST" "
|
|
set -euo pipefail
|
|
|
|
if grep -qF '${DIRECTIVE}' '${DNSMASQ_CONF}' 2>/dev/null; then
|
|
echo '==> Forwarder already configured, skipping write.'
|
|
else
|
|
echo '${DIRECTIVE}' | sudo tee '${DNSMASQ_CONF}'
|
|
echo '==> Written to ${DNSMASQ_CONF}'
|
|
fi
|
|
|
|
echo '==> Restarting Pi-hole DNS...'
|
|
sudo pihole restartdns
|
|
|
|
echo '==> Verifying SRV record resolution via Pi-hole...'
|
|
sleep 2
|
|
dig +short _kerberos._udp.${IPA_DOMAIN} SRV @127.0.0.1 || true
|
|
"
|
|
|
|
echo "==> Done. Pi-hole now forwards ${IPA_DOMAIN} queries to ${IPA_IP}."
|
|
echo " Verify from a LAN client:"
|
|
echo " dig +short _kerberos._udp.${IPA_DOMAIN} SRV @${PIHOLE_HOST}"
|