tommy
6002af049f
Captures the beast.goattw.net -> 192.168.99.200 intent (LIVE state still wrong at .185, correction never took), the NUT-must-not-depend-on-DNS design rule (ansible 3e5bfc4), and the open Technitium .184 config-backup verification. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
2.1 KiB
Markdown
43 lines
2.1 KiB
Markdown
# Internal DNS — source of truth
|
|
|
|
Technitium is authoritative for the **internal** view of `goattw.net` (split-horizon;
|
|
`goattw.net` is Cloudflare-fronted publicly). Technitium records are managed in the
|
|
**Technitium UI — there is no IaC**, so this file is the human source-of-truth: if a
|
|
record is wrong or a rebuild loses it, reconcile against this table.
|
|
|
|
- Primary DNS: **Technitium @ 192.168.99.184**
|
|
- Secondary DNS: **router @ 192.168.99.1** (serves the same answers; also went to .185 below)
|
|
|
|
## Records that must be correct
|
|
|
|
| Name | Must resolve to | Why |
|
|
|------|-----------------|-----|
|
|
| `beast.goattw.net` | **192.168.99.200** | Beast = PVE master / NUT (upsd) master. |
|
|
|
|
Note a broad `*.goattw.net → 192.168.99.185` internal-ingress pattern exists (e.g.
|
|
`pbs.goattw.net` also answers `.185`). Specific host records like `beast` must be
|
|
explicit A-records that override the wildcard.
|
|
|
|
## ⚠️ OPEN (2026-07-03): the beast correction did NOT take
|
|
|
|
`dig beast.goattw.net @192.168.99.184` returns **192.168.99.185** — authoritative
|
|
(`aa` flag, static TTL 3600), not a cache. The intended edit to `.200` was never
|
|
applied (or reverted). `.185` runs no `upsd`, which is what broke NUT (below).
|
|
**ACTION (supervised): re-add/fix `beast.goattw.net A → 192.168.99.200` in Technitium,
|
|
then re-verify `dig beast.goattw.net @192.168.99.184` → .200.**
|
|
|
|
## Design rule: NUT must not depend on DNS
|
|
|
|
Because `beast.goattw.net` regressed to `.185`, every node whose `upsmon.conf` monitored
|
|
`cyberpower*@beast.goattw.net` lost UPS communication (no graceful shutdown on power
|
|
events). Fixed by pinning the MONITOR target to the **IP `192.168.99.200`**, captured in
|
|
Ansible `deploy_nut_client.yml` (commit `3e5bfc4`). Affected nodes: pbs (hand-fixed
|
|
2026-07-03), compute2/3/4, docker-node01/02 (repaired on next supervised redeploy).
|
|
|
|
## OPEN: Technitium config backup
|
|
|
|
Confirm `.184`'s Technitium **config volume** is captured in a backup (so the internal
|
|
zone survives a rebuild) — either as a PBS VM/host backup of `.184`, or Technitium's own
|
|
**Settings → scheduled backup**. Status: **TO CONFIRM** (not verifiable without PVE/PBS
|
|
or `.184` access from the current host).
|