fizzlepoof/truenas-stacks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record full Pi-hole retirement
Some checks failed
secret-guardrails / artifact-secret-scan (push) Has been cancelled
Details
secret-guardrails / gitleaks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Fizzlepoof
2026-05-27 21:14:15 +00:00
parent 2ab4ff4428
commit 24c6a29273
9 changed files with 34 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
technitium-pilot/README.md
View File

@@ -9,7 +9,7 @@ Non-disruptive Technitium DNS Server pilot for PlausibleDeniability.
- Web console: `http://10.5.30.8/`
- Friendly hostname inside Technitium: `http://dns.home.paccoco.com/`
This pilot intentionally does not touch the live Pi-hole service on `10.5.30.6` or the client VIP on `10.5.30.53`.
This stack is no longer just a side-by-side pilot. It is the active DNS source of truth, and the old Pi-hole service/VIP path has been retired.
Current mirrored baseline from Pi-hole:
- blocklists:
@@ -33,7 +33,7 @@ Notes:
- Authentik native OIDC callback for Technitium is `https://dns.paccoco.com/sso/callback`.
- For Authentik native OIDC, the Technitium OAuth2 provider must have the default OpenID scope mappings attached: `openid`, `email`, and `profile`. Without them, Authentik will mint a token with no OpenID scopes and Technitium fails the `/application/o/userinfo/` call with `Scope mismatch` / `SSO authentication failed`.
- The authoritative zone `home.paccoco.com` is now hosted in Technitium with `dns.home.paccoco.com -> 10.5.30.8`.
- Clients will resolve `dns.home.paccoco.com` only when they query Technitium directly, or after DHCP/cutover points them at Technitium.
- Clients now resolve `dns.home.paccoco.com` through the Technitium trio because the Pi-hole VIP path has been retired.
- `bin/sync_backup_nodes.sh` is the PD-side replication runner that pushes the live Technitium config to the Nomad (`10.5.30.9`) and Serenity (`10.5.30.10`) backup nodes, then recycles those backup stacks and verifies both a private authoritative answer and a public recursive answer.
- Active automation model: root cron on PD runs the sync every 15 minutes from `/mnt/docker-ssd/docker/compose/technitium-pilot`, logging to `/mnt/tank/docker/appdata/technitium-pilot/logs/sync-backup-nodes.log`.
- External fallback `9.9.9.9` keeps general internet DNS available if the Technitium trio is down, but it is not a substitute for the private `home.paccoco.com` zone.