From 6002af049f52907b0983a4465241bde18cd358a1 Mon Sep 17 00:00:00 2001 From: tommy Date: Fri, 3 Jul 2026 11:29:43 -0500 Subject: [PATCH] runbooks: add dns-records.md source-of-truth Captures the beast.goattw.net -> 192.168.99.200 intent (LIVE state still wrong at .185, correction never took), the NUT-must-not-depend-on-DNS design rule (ansible 3e5bfc4), and the open Technitium .184 config-backup verification. Co-Authored-By: Claude Opus 4.8 --- runbooks/dns-records.md | 42 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 runbooks/dns-records.md diff --git a/runbooks/dns-records.md b/runbooks/dns-records.md new file mode 100644 index 0000000..d3fe2c5 --- /dev/null +++ b/runbooks/dns-records.md @@ -0,0 +1,42 @@ +# Internal DNS — source of truth + +Technitium is authoritative for the **internal** view of `goattw.net` (split-horizon; +`goattw.net` is Cloudflare-fronted publicly). Technitium records are managed in the +**Technitium UI — there is no IaC**, so this file is the human source-of-truth: if a +record is wrong or a rebuild loses it, reconcile against this table. + +- Primary DNS: **Technitium @ 192.168.99.184** +- Secondary DNS: **router @ 192.168.99.1** (serves the same answers; also went to .185 below) + +## Records that must be correct + +| Name | Must resolve to | Why | +|------|-----------------|-----| +| `beast.goattw.net` | **192.168.99.200** | Beast = PVE master / NUT (upsd) master. | + +Note a broad `*.goattw.net → 192.168.99.185` internal-ingress pattern exists (e.g. +`pbs.goattw.net` also answers `.185`). Specific host records like `beast` must be +explicit A-records that override the wildcard. + +## ⚠️ OPEN (2026-07-03): the beast correction did NOT take + +`dig beast.goattw.net @192.168.99.184` returns **192.168.99.185** — authoritative +(`aa` flag, static TTL 3600), not a cache. The intended edit to `.200` was never +applied (or reverted). `.185` runs no `upsd`, which is what broke NUT (below). +**ACTION (supervised): re-add/fix `beast.goattw.net A → 192.168.99.200` in Technitium, +then re-verify `dig beast.goattw.net @192.168.99.184` → .200.** + +## Design rule: NUT must not depend on DNS + +Because `beast.goattw.net` regressed to `.185`, every node whose `upsmon.conf` monitored +`cyberpower*@beast.goattw.net` lost UPS communication (no graceful shutdown on power +events). Fixed by pinning the MONITOR target to the **IP `192.168.99.200`**, captured in +Ansible `deploy_nut_client.yml` (commit `3e5bfc4`). Affected nodes: pbs (hand-fixed +2026-07-03), compute2/3/4, docker-node01/02 (repaired on next supervised redeploy). + +## OPEN: Technitium config backup + +Confirm `.184`'s Technitium **config volume** is captured in a backup (so the internal +zone survives a rebuild) — either as a PBS VM/host backup of `.184`, or Technitium's own +**Settings → scheduled backup**. Status: **TO CONFIRM** (not verifiable without PVE/PBS +or `.184` access from the current host).