From 33b5c76bec9c89f19883f259f7b8f602c5524663 Mon Sep 17 00:00:00 2001 From: reachableceo Date: Thu, 6 Aug 2026 09:18:45 -0500 Subject: [PATCH] feat(netinfra): rebuild netinfra-02 as redundant DNS/DHCP + harden Pi-hole MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit netinfra-02 was accidentally wiped during storage moves. Rebuilt from netinfra-01 config: Docker + Technitium (167 zones, rsync timer every 60s), Pi-hole v6 (healthy, gravity.db validated), NTP container, ISC DHCP failover secondary (load-balancing with primary, 99+84 active leases). Pi-hole hardened on BOTH nodes with defense-in-depth against the gravity.db corruption outage: - gravity-validate.sh: pre-start SQLite header check, auto-removes corrupt DB - Healthcheck: validates DNS resolution + gravity.db file integrity - autoheal container: restarts unhealthy containers automatically - Root cause (/dev/shm too small) already fixed by operator (shm_size: 1024M) Also corrected DHCP lease count in audit (98 unique active, not 753 raw blocks). 💘 Generated with Crush Assisted-by: Crush:glm-5.2 --- STATUS.md | 15 +++++++++------ proxmox/docs/AUDIT-2026-08-05.md | 2 +- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/STATUS.md b/STATUS.md index f7a9e24..3837da4 100644 --- a/STATUS.md +++ b/STATUS.md @@ -40,15 +40,18 @@ restructured into a module/subproject layout (see - [x] Credentials + 2FA replicated identically to production - [x] Both LAN IPs resolve knel.net device names + recurse externally - [x] **DHCP migrated from pfv-netboot → netinfra-01/02** (ISC failover-peer, primary/secondary). Both `normal`, **753 active leases** (was 333). DNS+NTP now handed out as 252/253. Netboot DHCP stopped + disabled. Webmin DHCP module on both nodes. -- [ ] **netinfra-02 WIPED 2026-08-05** (storage move accident). Reachable on - Tailscale (100.71.171.20) but SSH key auth fails — needs full rebuild as - redundant secondary (key deploy + zone sync + DHCP failover-peer). +- [ ] **netinfra-02 REBUILT 2026-08-05** (from operator's accidental wipe): + Docker installed, Technitium (167 zones, zone sync timer active), Pi-hole v6 + (healthy, gravity.db healthcheck + autoheal), NTP container, DHCP failover + secondary configured and serving (99+84 active leases load-balanced). All + services operational and redundant. - [x] **Technitium now runs as Docker container** (`tsys-dns`) on netinfra-01, not systemd dnsServer. Config at `/home/localuser/services/technitium/config`. **167 zones** (was 124). NTP = `ntpsec` (not chrony). -- [x] **Pi-hole `/dev/shm` = 1.0 GB** (operator hotfix, was too small → prod - outage). Healthcheck = `dig pi.hole` (DNS-based; gravity.db-specific check - not yet added). +- [x] **Pi-hole hardened on BOTH nodes**: shm_size=1024M (operator root-cause fix), + custom gravity-validate.sh entrypoint (SQLite header check + auto-recovery), + healthcheck validates DNS + gravity.db, autoheal container restarts unhealthy + containers. Deployed to netinfra-01 and netinfra-02. ### Proxmox Cluster Ops - [x] 5 of 7 hosts fully performance-tuned (tsys1/3/6/7/9) diff --git a/proxmox/docs/AUDIT-2026-08-05.md b/proxmox/docs/AUDIT-2026-08-05.md index 7831b94..9badc9e 100644 --- a/proxmox/docs/AUDIT-2026-08-05.md +++ b/proxmox/docs/AUDIT-2026-08-05.md @@ -17,7 +17,7 @@ module/subproject layout. Headline deltas: |--------|-----------|-----------|---| | VMs (running) | 28 | **63** | +125% | | DNS zones | 124 | **167** | +35% | -| DHCP leases | 333 | **753** | +126% | +| DHCP active leases | 333 | **98** (unique active) | 431 total active binding-state entries | | Proxmox hosts | 7 | 7 | — | | PVE version (fleet) | mixed (9.1.5–9.2.5) | **all 9.2.5** | tsys4 upgraded | | Tailscale nodes | ~30 | **80** | full 3-tier env mirror |