From 944af9597d376798a4c908cccaf92e80f4dce67d Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Wed, 29 Jul 2026 20:12:25 +1000 Subject: [PATCH] docs(dns): document DNS zone layout for all three networks Adds a DNS Zones section to ip-addressing.md covering the three FreeIPA zones (sweet.home / cluster.home / storage.home) with all A records and PTR records as configured. Updates Stage 6 in network-cutover.md to reference nfs.storage.home by DNS name rather than the raw VIP IP, and marks DNS as a completed prerequisite for the HA storage cutover. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2 --- docs/ip-addressing.md | 62 +++++++++++++++++++++++++++++++++++++++++ docs/network-cutover.md | 14 ++++++---- 2 files changed, 71 insertions(+), 5 deletions(-) diff --git a/docs/ip-addressing.md b/docs/ip-addressing.md index 8614408..408f523 100644 --- a/docs/ip-addressing.md +++ b/docs/ip-addressing.md @@ -25,6 +25,68 @@ is always `.228`: `192.168.2.228` (LAN), `192.168.10.228` (cluster), `192.168.20 --- +## DNS Zones + +FreeIPA (domain-controller.sweet.home) is authoritative for all zones. Three +zones correspond to the three subnets — one per VLAN. All zones are internal +only; no external delegation. + +### sweet.home — VLAN 2 (192.168.2.x) + +General LAN zone. All infrastructure hostnames live here. + +| Hostname | A record | Notes | +|---|---|---| +| `domain-controller.sweet.home` | `192.168.2.253` | FreeIPA / KDC / DNS | +| `ha-vip-lan.sweet.home` | `192.168.2.229` | Pacemaker `vip-lan` — NFS for LAN clients | +| `ha-server-1.sweet.home` | `192.168.2.228` | HA node 1 management NIC | +| `ha-server-2.sweet.home` | `192.168.2.227` | HA node 2 management NIC | +| `server.sweet.home` | `192.168.2.226` | Current ZFS/NFS server (retiring) | +| `docker.sweet.home` | `192.168.2.225` | Docker/Traefik host | +| `nix-cache.sweet.home` | `192.168.2.224` | Nix binary cache + remote builder | +| `pxe-boot.sweet.home` | `192.168.2.223` | PXE / TFTP / HTTP netboot | +| `tailscale-router.sweet.home` | `192.168.2.222` | Tailscale exit node | +| `tor-relay.sweet.home` | `192.168.2.221` | Tor relay | +| `pdm.sweet.home` | `192.168.2.220` | Proxmox Deploy Manager | +| `nixos.sweet.home` | `192.168.2.39` | Bare-metal workstation (DHCP) | +| `pve1.sweet.home` | `192.168.2.245` | Proxmox VE hypervisor | +| `pbs.sweet.home` | `192.168.2.244` | Proxmox Backup Server | + +PTR records exist for all static hosts. The workstation (`nixos.sweet.home`) is +DHCP-assigned; its PTR is omitted. + +### cluster.home — VLAN 10 (192.168.10.x) + +Internal only — Corosync ring0 heartbeat and DRBD replication between HA nodes. +No VIP exists on this subnet (DRBD/Corosync endpoints are static per-node IPs). + +| Hostname | A record | Notes | +|---|---|---| +| `ha-server-1.cluster.home` | `192.168.10.228` | HA node 1 cluster NIC (ens19 / vmbr1) | +| `ha-server-2.cluster.home` | `192.168.10.227` | HA node 2 cluster NIC (ens19 / vmbr1) | + +PTR records exist for both. DNS here is for debugging convenience — DRBD and +Corosync use the IPs from the NixOS config directly, not DNS. + +### storage.home — VLAN 20 (192.168.20.x) + +Internal only — NFS (and iSCSI) client access to the HA storage VIP. NFS clients +mount from **`nfs.storage.home`** (the Pacemaker floating VIP) so mounts survive +failover transparently without reconfiguration. + +| Hostname | A record | Notes | +|---|---|---| +| `nfs.storage.home` | `192.168.20.229` | Pacemaker `vip-storage` — NFS + iSCSI VIP | +| `ha-server-1.storage.home` | `192.168.20.228` | HA node 1 storage-client NIC (ens20 / vmbr2) | +| `ha-server-2.storage.home` | `192.168.20.227` | HA node 2 storage-client NIC (ens20 / vmbr2) | +| `docker.storage.home` | `192.168.20.225` | Docker host storage-client NIC (eth1 / vmbr2) | +| `server.storage.home` | `192.168.20.226` | server VM storage-client NIC (temporary) | + +PTR records exist for all five. `server.storage.home` and its PTR should be +removed when server.sweet.home is decommissioned (Stage 6d). + +--- + ## LAN — 192.168.2.0/24 ### Address map diff --git a/docs/network-cutover.md b/docs/network-cutover.md index 294d8c1..d32ad5b 100644 --- a/docs/network-cutover.md +++ b/docs/network-cutover.md @@ -338,9 +338,11 @@ temporarily use either. ## Stage 6 — HA storage cutover (docker NFS remount) -> **Prerequisite:** HA cluster fully deployed and `vip-storage` (192.168.20.229) serving -> NFS. docker CT must have eth1 on vmbr2 (already done). Final rsync from server.sweet.home -> to `/srv/ha-data` must be complete before this stage. +> **Prerequisites:** +> - HA cluster fully deployed and `vip-storage` (`nfs.storage.home` → 192.168.20.229) serving NFS ✓ +> - DNS configured: `storage.home` zone populated, `nfs.storage.home` resolves to 192.168.20.229 ✓ +> - docker CT has eth1 on vmbr2 (`docker.storage.home` → 192.168.20.225) ✓ +> - Final rsync from server.sweet.home to `/srv/ha-data` complete before step 6b docker.sweet.home currently NFS-mounts its persistent volumes from `server.sweet.home` (`192.168.2.226:/tank/docker/...`). This stage moves those mounts to the HA cluster's @@ -365,7 +367,7 @@ sudo rsync -av --delete /tank/docker/nextcloud-data/ wayne@:/srv ### 6b. Update docker NixOS config to mount from vip-storage In `hosts/docker/host.nix` (or wherever the NFS mount fileSystems are declared), change -the NFS server from `server.sweet.home` / `192.168.2.226` to `192.168.20.229`: +the NFS server from `server.sweet.home` / `192.168.2.226` to `nfs.storage.home`: ```nix # Before: @@ -376,11 +378,13 @@ fileSystems."/mnt/docker/config" = { # After: fileSystems."/mnt/docker/config" = { - device = "192.168.20.229:/srv/ha-data/docker/config"; + device = "nfs.storage.home:/srv/ha-data/docker/config"; ... }; ``` +Using the DNS name (`nfs.storage.home`) rather than the VIP IP means the mount +config survives a future VIP renumber without touching the NixOS config. Repeat for all four docker shares (`config`, `databases`, `volumes`, `nextcloud-data`). Then rebuild docker: