runbooks: add dns-records.md source-of-truth

Captures the beast.goattw.net -> 192.168.99.200 intent (LIVE state still wrong at .185, correction never took), the NUT-must-not-depend-on-DNS design rule (ansible 3e5bfc4), and the open Technitium .184 config-backup verification. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-03 11:29:43 -05:00
parent 5ba7246b45
commit 6002af049f
1 changed files with 42 additions and 0 deletions
@@ -0,0 +1,42 @@
+# Internal DNS — source of truth
+
+Technitium is authoritative for the **internal** view of `goattw.net` (split-horizon;
+`goattw.net` is Cloudflare-fronted publicly). Technitium records are managed in the
+**Technitium UI — there is no IaC**, so this file is the human source-of-truth: if a
+record is wrong or a rebuild loses it, reconcile against this table.
+
+- Primary DNS: **Technitium @ 192.168.99.184**
+- Secondary DNS: **router @ 192.168.99.1** (serves the same answers; also went to .185 below)
+
+## Records that must be correct
+
+| Name | Must resolve to | Why |
+|------|-----------------|-----|
+| `beast.goattw.net` | **192.168.99.200** | Beast = PVE master / NUT (upsd) master. |
+
+Note a broad `*.goattw.net → 192.168.99.185` internal-ingress pattern exists (e.g.
+`pbs.goattw.net` also answers `.185`). Specific host records like `beast` must be
+explicit A-records that override the wildcard.
+
+## ⚠️ OPEN (2026-07-03): the beast correction did NOT take
+
+`dig beast.goattw.net @192.168.99.184` returns **192.168.99.185** — authoritative
+(`aa` flag, static TTL 3600), not a cache. The intended edit to `.200` was never
+applied (or reverted). `.185` runs no `upsd`, which is what broke NUT (below).
+**ACTION (supervised): re-add/fix `beast.goattw.net A → 192.168.99.200` in Technitium,
+then re-verify `dig beast.goattw.net @192.168.99.184` → .200.**
+
+## Design rule: NUT must not depend on DNS
+
+Because `beast.goattw.net` regressed to `.185`, every node whose `upsmon.conf` monitored
+`cyberpower*@beast.goattw.net` lost UPS communication (no graceful shutdown on power
+events). Fixed by pinning the MONITOR target to the **IP `192.168.99.200`**, captured in
+Ansible `deploy_nut_client.yml` (commit `3e5bfc4`). Affected nodes: pbs (hand-fixed
+2026-07-03), compute2/3/4, docker-node01/02 (repaired on next supervised redeploy).
+
+## OPEN: Technitium config backup
+
+Confirm `.184`'s Technitium **config volume** is captured in a backup (so the internal
+zone survives a rebuild) — either as a PBS VM/host backup of `.184`, or Technitium's own
+**Settings → scheduled backup**. Status: **TO CONFIRM** (not verifiable without PVE/PBS
+or `.184` access from the current host).