From cab00585cad3d8420956aa8cd1e7c8f3c652e584 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Thu, 8 Oct 2026 13:26:53 -0700 Subject: [PATCH] docs(nh3-svos): svos names now also rewritten on the three internal AdGuards (mesh-reachable only) --- servers/nh3-svos/README.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/servers/nh3-svos/README.md b/servers/nh3-svos/README.md index 07be179..da647e6 100644 --- a/servers/nh3-svos/README.md +++ b/servers/nh3-svos/README.md @@ -68,7 +68,12 @@ scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml - **Mesh:** tailscaled joined headscale as `nh3-svos`, **100.64.0.9**, `--accept-dns=false --accept-routes=false`. - **Name:** `svos.phasefinal.com` exists ONLY as a headscale MagicDNS extra record (`/var/lib/headscale/extra-records.json` - on nh3-headscale, hot-reloaded) → 100.64.0.9. There is no public record and no internal AdGuard record. + on nh3-headscale, hot-reloaded) → 100.64.0.9. There is no public record. **Since 2026-10-08 (Prime: "internal name + servers don't resolve svos.phasefinal.com") the three internal AdGuards (ana `10.250.50.70:8053`, esh `10.0.50.45`, + nh3 `10.100.50.40`) also carry hand-made rewrites** `svos.phasefinal.com` and `svos-terminal.phasefinal.com` → + `100.64.0.9`, outside `dns-sync.py`'s `.internal` authority, like `*.nh3.phasefinal.com`. The name now resolves + everywhere, but only a **mesh client** can connect: LAN-only hosts at all three sites get `000` (no route to + 100.64.0.0/10), measured 10-08. - **TLS:** Caddy 2.11.4 (the fleet `caddy-cf` build with the Cloudflare DNS module) at `/usr/local/bin/caddy`, unit `caddy-svos.service`, config `/etc/caddy/Caddyfile` (canonical `configs/svos-front/Caddyfile`). It listens **only on 100.64.0.9:443**, with no `:80`. The LE cert for `svos.phasefinal.com` comes via DNS-01, token `nh3-svos-caddy-dns01`