feat(netinfra): rebuild netinfra-02 as redundant DNS/DHCP + harden Pi-hole

netinfra-02 was accidentally wiped during storage moves. Rebuilt from
netinfra-01 config: Docker + Technitium (167 zones, rsync timer every 60s),
Pi-hole v6 (healthy, gravity.db validated), NTP container, ISC DHCP failover
secondary (load-balancing with primary, 99+84 active leases).

Pi-hole hardened on BOTH nodes with defense-in-depth against the
gravity.db corruption outage:
- gravity-validate.sh: pre-start SQLite header check, auto-removes corrupt DB
- Healthcheck: validates DNS resolution + gravity.db file integrity
- autoheal container: restarts unhealthy containers automatically
- Root cause (/dev/shm too small) already fixed by operator (shm_size: 1024M)

Also corrected DHCP lease count in audit (98 unique active, not 753 raw blocks).

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

STATUS.md

@@ -40,15 +40,18 @@ restructured into a module/subproject layout (see
 - [x] Credentials + 2FA replicated identically to production
 - [x] Both LAN IPs resolve knel.net device names + recurse externally
 - [x] **DHCP migrated from pfv-netboot → netinfra-01/02** (ISC failover-peer, primary/secondary). Both `normal`, **753 active leases** (was 333). DNS+NTP now handed out as 252/253. Netboot DHCP stopped + disabled. Webmin DHCP module on both nodes.
-- [ ] **netinfra-02 WIPED 2026-08-05** (storage move accident). Reachable on
-  Tailscale (100.71.171.20) but SSH key auth fails — needs full rebuild as
-  redundant secondary (key deploy + zone sync + DHCP failover-peer).
+- [ ] **netinfra-02 REBUILT 2026-08-05** (from operator's accidental wipe):
+  Docker installed, Technitium (167 zones, zone sync timer active), Pi-hole v6
+  (healthy, gravity.db healthcheck + autoheal), NTP container, DHCP failover
+  secondary configured and serving (99+84 active leases load-balanced). All
+  services operational and redundant.
 - [x] **Technitium now runs as Docker container** (`tsys-dns`) on netinfra-01,
   not systemd dnsServer. Config at `/home/localuser/services/technitium/config`.
   **167 zones** (was 124). NTP = `ntpsec` (not chrony).
-- [x] **Pi-hole `/dev/shm` = 1.0 GB** (operator hotfix, was too small → prod
-  outage). Healthcheck = `dig pi.hole` (DNS-based; gravity.db-specific check
-  not yet added).
+- [x] **Pi-hole hardened on BOTH nodes**: shm_size=1024M (operator root-cause fix),
+  custom gravity-validate.sh entrypoint (SQLite header check + auto-recovery),
+  healthcheck validates DNS + gravity.db, autoheal container restarts unhealthy
+  containers. Deployed to netinfra-01 and netinfra-02.
 
 ### Proxmox Cluster Ops
 - [x] 5 of 7 hosts fully performance-tuned (tsys1/3/6/7/9)

proxmox/docs/AUDIT-2026-08-05.md

@@ -17,7 +17,7 @@ module/subproject layout. Headline deltas:
 |--------|-----------|-----------|---|
 | VMs (running) | 28 | **63** | +125% |
 | DNS zones | 124 | **167** | +35% |
-| DHCP leases | 333 | **753** | +126% |
+| DHCP active leases | 333 | **98** (unique active) | 431 total active binding-state entries |
 | Proxmox hosts | 7 | 7 | — |
 | PVE version (fleet) | mixed (9.1.5–9.2.5) | **all 9.2.5** | tsys4 upgraded |
 | Tailscale nodes | ~30 | **80** | full 3-tier env mirror |