Add internal Traefik ingress for Pangolin and Authelia

technitium-pilot/README.md

@@ -0,0 +1,32 @@
+# Technitium DNS pilot on PD
+
+Non-disruptive Technitium DNS Server pilot for PlausibleDeniability.
+
+- Repo stack path: `/home/fizzlepoof/repos/truenas-stacks/technitium-pilot`
+- Live PD stack path: `/mnt/docker-ssd/docker/compose/technitium-pilot`
+- Pilot bind IP: `10.5.30.8`
+- DNS ports: `53/tcp`, `53/udp`
+- Web console: `http://10.5.30.8/`
+- Friendly hostname inside Technitium: `http://dns.home.paccoco.com/`
+
+This pilot intentionally does not touch the live Pi-hole service on `10.5.30.6` or the client VIP on `10.5.30.53`.
+
+Current mirrored baseline from Pi-hole:
+- blocklists:
+  - `https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts`
+  - `https://big.oisd.nl`
+- no custom local DNS entries detected
+- no conditional forwarding detected
+- no extra dnsmasq fragments detected
+
+Pilot-specific adaptation:
+- Production Pi-hole forwards to PD-local Unbound on `127.0.0.1:5335`.
+- Because the Technitium pilot uses a dedicated macvlan IP, that loopback-only upstream is not reachable from the pilot without changing production Unbound.
+- For pilot safety, Technitium is seeded as a standalone recursive resolver instead of reconfiguring production Unbound.
+
+Notes:
+- The stack binds only to `TECHNITIUM_BIND_IP`, so PD must have that secondary address present on `LAN_INTERFACE` before `docker compose up`.
+- The helper script adds the pilot IP alias read/write on the live host for the current boot only. That is deliberate for pilot safety.
+- Technitium reads the environment initialization only on first boot when `/etc/dns` is empty. If you need to re-seed initial settings, stop the container and clear the config directory first.
+- The authoritative zone `home.paccoco.com` is now hosted in Technitium with `dns.home.paccoco.com -> 10.5.30.8`.
+- Clients will resolve `dns.home.paccoco.com` only when they query Technitium directly, or after DHCP/cutover points them at Technitium.