Sync network redesign repo state and cutover artifacts

pihole/nomad/.env.example

@@ -5,7 +5,7 @@ PIHOLE_WEB_PORT=8954
 NOMAD_PIHOLE_WEB_PORT=8954
 PIHOLE_PASSWORD=CHANGE_ME
 LAN_INTERFACE=enp5s0
-VIP_CIDR=10.5.1.53/24
+VIP_CIDR=10.5.30.53/24
 KEEPALIVED_ROUTER_ID=53
 KEEPALIVED_STATE=BACKUP
 KEEPALIVED_PRIORITY=90

pihole/nomad/README.md

@@ -1,11 +1,17 @@
-# NOMAD Pi-hole / Unbound / Keepalived Replica
+# NOMAD Pi-hole / Unbound / staged Keepalived Replica
 
 - **Repo stack path:** `/home/fizzlepoof/repos/truenas-stacks/pihole/nomad`
 - **Suggested live stack path:** `/opt/pihole-nomad`
-- **Node role:** NOMAD backup / BACKUP1
-- **VIP target:** `10.5.1.53/24`
+- **Node role:** NOMAD Pi-hole replica on Servers VLAN
+- **Staged future VIP target:** `10.5.30.53/24`
 - **LAN interface:** `enp5s0`
-- **NOMAD LAN IP:** `10.5.1.16`
+- **NOMAD LAN IP:** `10.5.30.7`
+
+Current state:
+
+- `pihole-nomad` and `unbound-pihole-nomad` stay up normally on NOMAD.
+- `keepalived-pihole-nomad` is intentionally disabled by default after NOMAD moved from Trusted to Servers VLAN.
+- Enable HA later with `COMPOSE_PROFILES=ha` only after a same-subnet peer and VIP design are ready.
 
 Bring-up:
 
@@ -34,7 +40,9 @@ Pi-hole on NOMAD is pinned to `enp5s0` with `FTLCONF_dns_interface=enp5s0` and `
 Current live containers:
 - `pihole-nomad`
 - `unbound-pihole-nomad`
+
+Staged but disabled-by-default HA container:
 - `keepalived-pihole-nomad`
 
 Current LAN admin URL:
-- `http://10.5.1.16:8954/admin/`
+- `http://10.5.30.7:8954/admin/`

pihole/nomad/docker-compose.yaml

@@ -51,6 +51,7 @@ services:
     image: osixia/keepalived:2.0.20
     container_name: keepalived-pihole-nomad
     network_mode: host
+    profiles: ["ha"]
     restart: unless-stopped
     depends_on:
       pihole:

pihole/nomad/keepalived.conf

@@ -23,7 +23,7 @@ vrrp_instance VI_DNS {
     }
 
     virtual_ipaddress {
-        10.5.1.53/24
+        10.5.30.53/24
     }
 
     track_script {