feat(netinfra): add 18 VM DHCP reservations + PTR records [#420]

Pinned every production VM to its current ARP-observed LAN IP via DHCP
reservation. No IP changes — purely converts dynamic leases to fixed.
Added PTR-only records in Technitium (no forward records needed; those
point to Tailscale 100.x addresses).

DHCP failover sync triggered manually to netinfra-02. Live dhcpd.conf
pulled into repo.

Remaining: pfv-k8s-wnode-tsys9 + DellOpenManageEnterprise offline (not
in ARP table). Stale MAC on existing tsys-siem reservation flagged for
cleanup (Hyper-V MAC vs current Proxmox MAC).

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

WORKING.md

@@ -7,7 +7,10 @@ A commit is blocked while any task below remains unchecked.
 
 (all done — session complete)
 
-- [x] Add ticket-closing policy: never close without user permission (AGENTS.md + meta template)
+- [x] Build VM MAC→IP mapping from ARP table + Proxmox data
-- [x] Reopen #407 (KNELCredsManager not complete)
+- [x] Generate dhcpd.conf host reservations (18 production VMs, current IPs)
-- [x] Correct Vault understanding (deployed on Cloudron, not k8s)
+- [x] Deploy reservations to netinfra-01 (syntax check passed, DHCP reloaded)
-- [x] Create #420 (VM DHCP reservations + LAN reverse DNS)
+- [x] Sync to netinfra-02 (manual trigger, confirmed)
+- [x] Add PTR records in Technitium (18 PTR-only records, verified)
+- [x] Pull updated dhcpd.conf into repo
+- [x] Create #421 (inotify DHCP sync, someday/maybe)

netinfra/dhcp/dhcpd-primary.conf

@@ -45,11 +45,11 @@ subnet 192.168.0.0 netmask 255.255.252.0 {
 
   # ---- host reservations (fixed-address; not subject to failover pool) ----
 
-  host pfv-r3-mgmt {
+  host pfv-r3-tor-mgmt-01 {
     hardware ethernet 00:14:22:69:1c:37;
     fixed-address 192.168.0.7;
   }
-  host pfv-r3-stor {
+  host pfv-r3-tor-stor-01 {
     hardware ethernet 00:13:72:46:95:e4;
     fixed-address 192.168.0.9;
   }
@@ -57,7 +57,7 @@ subnet 192.168.0.0 netmask 255.255.252.0 {
     hardware ethernet 40:9f:38:b0:b5:2f;
     fixed-address 192.168.1.84;
   }
-  host pfv-r2-tor1 {
+  host pfv-r2-tor-01 {
     hardware ethernet 00:0d:56:41:7a:4d;
     fixed-address 192.168.0.10;
   }
@@ -177,11 +177,66 @@ subnet 192.168.0.0 netmask 255.255.252.0 {
     hardware ethernet a4:bb:6d:e3:56:86;
     fixed-address 192.168.3.58;
   }
+	# umbrel
+	host tsys-umbrel {
+		hardware ethernet 02:2E:FF:8E:A2:D2;
+		fixed-address 192.168.1.97;
+		}
+	# ultix-streaming
+	host ultix-streaming {
+		hardware ethernet bc:24:11:1a:8f:6f;
+		fixed-address 192.168.3.78;
+		}
+	# ultix-offstage
+	host ultix-offstge {
+		hardware ethernet bc:24:11:1f:9d:83;
+		fixed-address 192.168.3.79;
+		}
+	# ultix-highside
+	host ultix-highside {
+		hardware ethernet a0:4a:5e:ca:46:f3;
+		fixed-address 192.168.3.32;
+		}
+	# pfv-k8s-cnode1
+	host pfv-k8s-cnode1 {
+		hardware ethernet bc:24:11:cb:97:10;
+		fixed-address 192.168.1.91;
+		}
+	# pfv-k8s-cnode2
+	host pfv-k8s-cnode2 {
+		hardware ethernet bc:24:11:40:25:f8;
+		fixed-address 192.168.3.113;
+		}
+	# pfv-k8s-cnode3
+	host pfv-k8s-cnode3 {
+		hardware ethernet bc:24:11:38:c0:58;
+		fixed-address 192.168.1.228;
+		}
+	# devbox-cloudron
+	host devbox-cloudron {
+		hardware ethernet bc:24:11:f7:b1:07;
+		fixed-address 192.168.1.6;
+		}
+	# hfnoc-uisp
+	host hfnoc-uisp {
+		hardware ethernet bc:24:11:a3:87:61;
+		fixed-address 192.168.3.193;
+		}
+	# kali-rd
+	host kali-rd {
+		hardware ethernet bc:24:11:9e:1c:e9;
+		fixed-address 192.168.2.37;
+		}
+	# kali-tsys
+	host kali-tsys {
+		hardware ethernet bc:24:11:16:22:d4;
+		fixed-address 192.168.1.114;
+		}
 }
 
 # ---- host declarations outside subnet (global scope, same as netboot) ----
 
-host subodev-torsw01 {
+host pfv-r6-mgmt-01 {
   hardware ethernet 00:14:22:69:18:a7;
   fixed-address 192.168.0.8;
 }
@@ -189,7 +244,80 @@ host pfv-r1-tor-top {
   hardware ethernet 00:23:ae:c1:ad:e8;
   fixed-address 192.168.0.11;
 }
-host tailscale-router {
+
-  hardware ethernet bc:24:11:8a:69:04;
+# --- VM DHCP reservations (generated 2026-08-11, ticket #420) ---
-  fixed-address 192.168.3.16;
+# All pinned to current ARP-observed IPs. No forward DNS needed
-}
+# (forward records point to Tailscale 100.x addresses).
+
+  host tsys-ca {
+    hardware ethernet bc:24:11:32:d0:36;
+    fixed-address 192.168.1.181;
+  }
+  host pfv-netinfra-01 {
+    hardware ethernet bc:24:11:65:b2:ac;
+    fixed-address 192.168.3.252;
+  }
+  host pfv-netinfra-02 {
+    hardware ethernet bc:24:11:e4:37:53;
+    fixed-address 192.168.3.253;
+  }
+  host tsys-librenms {
+    hardware ethernet bc:24:11:5c:96:1e;
+    fixed-address 192.168.3.176;
+  }
+  host tsys-proxmox-datacenter {
+    hardware ethernet bc:24:11:e6:03:2d;
+    fixed-address 192.168.2.44;
+  }
+  host pfv-k8s-wnode-tsys3 {
+    hardware ethernet bc:24:11:ee:7e:7b;
+    fixed-address 192.168.1.98;
+  }
+  host pfv-proxmox-backup-server {
+    hardware ethernet bc:24:11:6e:12:69;
+    fixed-address 192.168.2.193;
+  }
+  host pfv-k8s-wnode-tsys5 {
+    hardware ethernet bc:24:11:c7:a8:6c;
+    fixed-address 192.168.1.5;
+  }
+  host preprod-hfnoc-uisp {
+    hardware ethernet bc:24:11:74:d6:8a;
+    fixed-address 192.168.3.192;
+  }
+  host tsys-awx {
+    hardware ethernet bc:24:11:80:0d:16;
+    fixed-address 192.168.3.115;
+  }
+  host pfv-rr-middleware-02 {
+    hardware ethernet bc:24:11:96:0e:ee;
+    fixed-address 192.168.1.117;
+  }
+  host tsys-proxmox-mailgw-01 {
+    hardware ethernet bc:24:11:56:61:18;
+    fixed-address 192.168.1.11;
+  }
+  host pfv-k8s-wnode-tsys7 {
+    hardware ethernet bc:24:11:30:b8:07;
+    fixed-address 192.168.1.109;
+  }
+  host pfv-rr-middleware-01 {
+    hardware ethernet bc:24:11:1e:61:cf;
+    fixed-address 192.168.1.110;
+  }
+  host tsys-voip {
+    hardware ethernet bc:24:11:23:ce:04;
+    fixed-address 192.168.1.70;
+  }
+  host tsys-proxmox-mailgw-02 {
+    hardware ethernet bc:24:11:5f:e5:2c;
+    fixed-address 192.168.1.10;
+  }
+  host pfv-k8s-wnode-tsys6 {
+    hardware ethernet bc:24:11:fa:6e:b5;
+    fixed-address 192.168.1.111;
+  }
+  host tsys-siem-new {
+    hardware ethernet bc:24:11:ee:67:e2;
+    fixed-address 192.168.1.223;
+  }