From 6cdae391f4b92989b5d0a92a58330ceb5401bb30 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 14:03:22 +1000 Subject: [PATCH] fix(docker): pin IPA dyndns to eth0 to prevent Docker bridge IP registration SSSD's dyndns_iface defaults to "*" which registers every interface's IP in IPA DNS, including all Docker bridge networks (172.x.x.x). This caused docker.sweet.home to resolve to Docker bridge IPs instead of 192.168.2.225. Co-Authored-By: Claude Sonnet 4.6 --- hosts/docker/host.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hosts/docker/host.nix b/hosts/docker/host.nix index 4f9fda4..fb684f4 100644 --- a/hosts/docker/host.nix +++ b/hosts/docker/host.nix @@ -14,6 +14,11 @@ }; boot.zfs.forceImportRoot = false; + # Only advertise the LAN interface to IPA DNS. Without this, SSSD registers + # every Docker bridge (172.x.x.x) as an A record for docker.sweet.home — + # the default dyndns.interface = "*" catches them all. + security.ipa.dyndns.interface = vars.lxcLanInterface; # eth0 + # Preserved from the pre-refactor `docker` target — stateVersion must never # be bumped on an already-installed machine. system.stateVersion = "25.05";