beatzaplentyandClaude Sonnet 4.6
761fe9e194
- IPA now runs at 192.168.2.253 (previously shown as .138 in install docs) - cloud-init nameserver and nmcli DNS during install use .254 (gateway) since IPA isn't running yet at that point - --forwarder updated to 192.168.2.254 (LAN gateway, Pi-hole is gone) - Remove Step 7 (Pi-hole DNS forwarding config) from install.md - Delete obsolete freeipa/docs/pihole-dns.md and configure-pihole-dns.sh - Update CLAUDE.md section count and freeipa/ guidance entry - Update freeipa/README.md IP and DNS forwarding description Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
FreeIPA — domain-controller.sweet.home
FreeIPA 4.x identity management server providing Kerberos, LDAP, and
integrated DNS for the sweet.home LAN. Runs on Rocky Linux 9 in a
Proxmox VM (VMID 108 on pve1.sweet.home).
Quick status
| Item | Value |
|---|---|
| Host | domain-controller.sweet.home |
| IP | 192.168.2.253 (static) |
| Realm | SWEET.HOME |
| Domain | sweet.home |
| IPA version | 4.13.x (Rocky Linux 9) |
| Web UI | https://domain-controller.sweet.home/ipa/ui/ |
| VMID | 108 on pve1.sweet.home |
| OS | Rocky Linux 9 (GenericCloud image) |
What it provides
- Kerberos KDC — SSO tickets for the
SWEET.HOMErealm - LDAP directory — centralised user/group/host store (389-ds)
- Integrated DNS — authoritative for
sweet.homeand primary LAN resolver for all hosts, forwarding everything else to the LAN gateway - CA — self-signed CA issuing certs for IPA services
- Web UI — at
https://domain-controller.sweet.home/ipa/ui/
First-time use
# SSH to the server
ssh wayne@domain-controller
# Get a Kerberos ticket as admin
kinit admin
# List IPA users
ipa user-find
# Add a user
ipa user-add jdoe --first=John --last=Doe --password
# Check service health
ipactl status
Credentials
The admin Kerberos password and Directory Manager password were
generated at install time. They are not stored in this repo — keep
them in your password manager.
- admin — used for day-to-day IPA management (
kinit admin) - Directory Manager — low-level LDAP root, rarely needed
To reset the admin password (requires being logged in as admin):
kinit admin
ipa passwd admin
Ports required (firewalld)
FreeIPA's firewalld config is applied by ipa-server-install automatically.
The following ports must be reachable from LAN clients:
| Port | Proto | Service |
|---|---|---|
| 80 | TCP | HTTP (redirect to HTTPS) |
| 443 | TCP | HTTPS / Web UI |
| 389 | TCP | LDAP |
| 636 | TCP | LDAPS |
| 88 | TCP+UDP | Kerberos |
| 464 | TCP+UDP | Kerberos password change |
| 53 | TCP+UDP | DNS |
Reproducing this setup
See docs/install.md for the full step-by-step install procedure,
or run scripts/install.sh on a fresh Rocky Linux 9 VM with the
correct hostname and IP already set.
Backup
The CA certificates (required for replicas) are at /root/cacert.p12
on the server, encrypted with the Directory Manager password.
Back these up to a secure location.