beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(dns): document DNS zone layout for all three networks
Check NixOS configurations / eval-hosts (push) Failing after 14m52s
Details

Browse Source 
Adds a DNS Zones section to ip-addressing.md covering the three FreeIPA
zones (sweet.home / cluster.home / storage.home) with all A records and PTR
records as configured. Updates Stage 6 in network-cutover.md to reference
nfs.storage.home by DNS name rather than the raw VIP IP, and marks DNS as a
completed prerequisite for the HA storage cutover.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2
This commit is contained in:
beatzaplenty
2026-07-29 20:12:25 +10:00
co-authored by Claude Sonnet 4.6
parent 4f0b07031d
commit 944af9597d
2 changed files with 71 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ip-addressing.md
+62
View File
@@ -25,6 +25,68 @@ is always `.228`: `192.168.2.228` (LAN), `192.168.10.228` (cluster), `192.168.20
---
## DNS Zones
FreeIPA (domain-controller.sweet.home) is authoritative for all zones. Three
zones correspond to the three subnets — one per VLAN. All zones are internal
only; no external delegation.
### sweet.home — VLAN 2 (192.168.2.x)
General LAN zone. All infrastructure hostnames live here.
| Hostname | A record | Notes |
|---|---|---|
| `domain-controller.sweet.home` | `192.168.2.253` | FreeIPA / KDC / DNS |
| `ha-vip-lan.sweet.home` | `192.168.2.229` | Pacemaker `vip-lan` — NFS for LAN clients |
| `ha-server-1.sweet.home` | `192.168.2.228` | HA node 1 management NIC |
| `ha-server-2.sweet.home` | `192.168.2.227` | HA node 2 management NIC |
| `server.sweet.home` | `192.168.2.226` | Current ZFS/NFS server (retiring) |
| `docker.sweet.home` | `192.168.2.225` | Docker/Traefik host |
| `nix-cache.sweet.home` | `192.168.2.224` | Nix binary cache + remote builder |
| `pxe-boot.sweet.home` | `192.168.2.223` | PXE / TFTP / HTTP netboot |
| `tailscale-router.sweet.home` | `192.168.2.222` | Tailscale exit node |
| `tor-relay.sweet.home` | `192.168.2.221` | Tor relay |
| `pdm.sweet.home` | `192.168.2.220` | Proxmox Deploy Manager |
| `nixos.sweet.home` | `192.168.2.39` | Bare-metal workstation (DHCP) |
| `pve1.sweet.home` | `192.168.2.245` | Proxmox VE hypervisor |
| `pbs.sweet.home` | `192.168.2.244` | Proxmox Backup Server |
PTR records exist for all static hosts. The workstation (`nixos.sweet.home`) is
DHCP-assigned; its PTR is omitted.
### cluster.home — VLAN 10 (192.168.10.x)
Internal only — Corosync ring0 heartbeat and DRBD replication between HA nodes.
No VIP exists on this subnet (DRBD/Corosync endpoints are static per-node IPs).
| Hostname | A record | Notes |
|---|---|---|
| `ha-server-1.cluster.home` | `192.168.10.228` | HA node 1 cluster NIC (ens19 / vmbr1) |
| `ha-server-2.cluster.home` | `192.168.10.227` | HA node 2 cluster NIC (ens19 / vmbr1) |
PTR records exist for both. DNS here is for debugging convenience — DRBD and
Corosync use the IPs from the NixOS config directly, not DNS.
### storage.home — VLAN 20 (192.168.20.x)
Internal only — NFS (and iSCSI) client access to the HA storage VIP. NFS clients
mount from **`nfs.storage.home`** (the Pacemaker floating VIP) so mounts survive
failover transparently without reconfiguration.
| Hostname | A record | Notes |
|---|---|---|
| `nfs.storage.home` | `192.168.20.229` | Pacemaker `vip-storage` — NFS + iSCSI VIP |
| `ha-server-1.storage.home` | `192.168.20.228` | HA node 1 storage-client NIC (ens20 / vmbr2) |
| `ha-server-2.storage.home` | `192.168.20.227` | HA node 2 storage-client NIC (ens20 / vmbr2) |
| `docker.storage.home` | `192.168.20.225` | Docker host storage-client NIC (eth1 / vmbr2) |
| `server.storage.home` | `192.168.20.226` | server VM storage-client NIC (temporary) |
PTR records exist for all five. `server.storage.home` and its PTR should be
removed when server.sweet.home is decommissioned (Stage 6d).
---
## LAN — 192.168.2.0/24
### Address map
docs/network-cutover.md
+9 -5
View File
@@ -338,9 +338,11 @@ temporarily use either.
## Stage 6 — HA storage cutover (docker NFS remount)
> **Prerequisite:** HA cluster fully deployed and `vip-storage` (192.168.20.229) serving
> NFS. docker CT must have eth1 on vmbr2 (already done). Final rsync from server.sweet.home
> to `/srv/ha-data` must be complete before this stage.
> **Prerequisites:**
> - HA cluster fully deployed and `vip-storage` (`nfs.storage.home` → 192.168.20.229) serving NFS ✓
> - DNS configured: `storage.home` zone populated, `nfs.storage.home` resolves to 192.168.20.229 ✓
> - docker CT has eth1 on vmbr2 (`docker.storage.home` → 192.168.20.225) ✓
> - Final rsync from server.sweet.home to `/srv/ha-data` complete before step 6b
docker.sweet.home currently NFS-mounts its persistent volumes from `server.sweet.home`
(`192.168.2.226:/tank/docker/...`). This stage moves those mounts to the HA cluster's
@@ -365,7 +367,7 @@ sudo rsync -av --delete /tank/docker/nextcloud-data/ wayne@<active-node-ip>:/srv
### 6b. Update docker NixOS config to mount from vip-storage
In `hosts/docker/host.nix` (or wherever the NFS mount fileSystems are declared), change
the NFS server from `server.sweet.home` / `192.168.2.226` to `192.168.20.229`:
the NFS server from `server.sweet.home` / `192.168.2.226` to `nfs.storage.home`:
```nix
# Before:
@@ -376,11 +378,13 @@ fileSystems."/mnt/docker/config" = {
# After:
fileSystems."/mnt/docker/config" = {
device = "192.168.20.229:/srv/ha-data/docker/config";
device = "nfs.storage.home:/srv/ha-data/docker/config";
...
};
```
Using the DNS name (`nfs.storage.home`) rather than the VIP IP means the mount
config survives a future VIP renumber without touching the NixOS config.
Repeat for all four docker shares (`config`, `databases`, `volumes`, `nextcloud-data`).
Then rebuild docker: