# Internal DNS — source of truth

Technitium is authoritative for the **internal** view of `goattw.net` (split-horizon;
`goattw.net` is Cloudflare-fronted publicly). Technitium records are managed in the
**Technitium UI — there is no IaC**, so this file is the human source-of-truth: if a
record is wrong or a rebuild loses it, reconcile against this table.

- Primary DNS: **Technitium @ 192.168.99.184**
- Secondary DNS: **router @ 192.168.99.1** (serves the same answers; also went to .185 below)

## Records that must be correct

| Name | Must resolve to | Why |
|------|-----------------|-----|
| `beast.goattw.net` | **192.168.99.200** | Beast = PVE master / NUT (upsd) master. |

Note a broad `*.goattw.net → 192.168.99.185` internal-ingress pattern exists (e.g.
`pbs.goattw.net` also answers `.185`). Specific host records like `beast` must be
explicit A-records that override the wildcard.

## ⚠️ OPEN (2026-07-03): the beast correction did NOT take

`dig beast.goattw.net @192.168.99.184` returns **192.168.99.185** — authoritative
(`aa` flag, static TTL 3600), not a cache. The intended edit to `.200` was never
applied (or reverted). `.185` runs no `upsd`, which is what broke NUT (below).
**ACTION (supervised): re-add/fix `beast.goattw.net A → 192.168.99.200` in Technitium,
then re-verify `dig beast.goattw.net @192.168.99.184` → .200.**

## Design rule: NUT must not depend on DNS

Because `beast.goattw.net` regressed to `.185`, every node whose `upsmon.conf` monitored
`cyberpower*@beast.goattw.net` lost UPS communication (no graceful shutdown on power
events). Fixed by pinning the MONITOR target to the **IP `192.168.99.200`**, captured in
Ansible `deploy_nut_client.yml` (commit `3e5bfc4`). Affected nodes: pbs (hand-fixed
2026-07-03), compute2/3/4, docker-node01/02 (repaired on next supervised redeploy).

## OPEN: Technitium config backup

Confirm `.184`'s Technitium **config volume** is captured in a backup (so the internal
zone survives a rebuild) — either as a PBS VM/host backup of `.184`, or Technitium's own
**Settings → scheduled backup**. Status: **TO CONFIRM** (not verifiable without PVE/PBS
or `.184` access from the current host).