beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update network topology: Tailscale routing and DNS proxy, remove Pi-hole

Browse Source 
- Document bidirectional LAN ↔ Tailscale routing via tailscale-router
  (static route on router for 100.64.0.0/10, subnet advertisement into Tailnet)
- Document DNS proxy chain: FreeIPA conditional forwarder for *.ts.net
  → tailscale-router → MagicDNS; reverse for *.sweet.home from Tailscale clients
- Remove stale pihole.sweet.home from IP table (decommissioned)
- Fix freeipa role: remove Pi-hole IP from ipa_dns_forwarder, document
  ts.net conditional forwarder as a post-install step
- Fix inventory: remove Pi-hole forwarder IP, add ts.net forwarder note

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UvNjoxTWEDkhXsd1Dq2ETP
This commit is contained in:
beatzaplenty
2026-07-30 07:10:03 +10:00
co-authored by Claude Sonnet 4.6
parent f85c65870f
commit 78fdf3d94c
4 changed files with 64 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/internal/architecture.md
+15
View File
@@ -52,6 +52,7 @@ FreeIPA (`SWEET.HOME` realm) provides:
- Kerberos SSO for all IPA-enrolled hosts
- LDAP user/group directory (`admins`, `docker-access` groups)
- Authoritative DNS for the entire LAN (Pi-hole decommissioned; FreeIPA is the sole resolver)
- Conditional forwarder: `*.ts.net` → `tailscale-router` (192.168.2.222) → Tailscale MagicDNS
- Certificate authority for internal TLS
All hosts (Proxmox nodes, Raspberry Pi, Docker host) are IPA-enrolled via SSSD.
@@ -60,6 +61,20 @@ The `docker-access` group (GID 50010) grants Docker socket access on Docker host
DHCP is handled by the router. PXE-specific DHCP options are served by the `pxe-boot` LXC.
## Tailscale ↔ LAN bridge
`tailscale-router.sweet.home` (192.168.2.222) is a NixOS LXC running the `tailscale-router`
build type. It provides full bidirectional connectivity between the LAN and the Tailnet:
- **LAN → Tailscale:** Router has a static route for `100.64.0.0/10` (Tailscale CGNAT) → 192.168.2.222.
DNS for `*.ts.net` flows through FreeIPA's conditional forwarder → tailscale-router → MagicDNS.
- **Tailscale → LAN:** tailscale-router advertises `192.168.2.0/24` as a subnet route.
Tailscale clients use tailscale-router as a split-horizon DNS forwarder for `sweet.home`,
which proxies those queries to FreeIPA.
This means any Tailscale-connected device can resolve and reach `*.sweet.home` hosts, and
any LAN host can resolve and reach `*.ts.net` hosts — without needing a Tailscale client installed.
## Monitoring stack
```