docs(nh3-svos): svos names now also rewritten on the three internal AdGuards (mesh-reachable only)

2026-10-08 13:26:53 -07:00
parent 2f587b0d92
commit cab00585ca
1 changed files with 6 additions and 1 deletions
@@ -68,7 +68,12 @@ scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml
 - **Mesh:** tailscaled joined headscale as `nh3-svos`, **100.64.0.9**, `--accept-dns=false --accept-routes=false`.
 - **Name:** `svos.phasefinal.com` exists ONLY as a headscale MagicDNS extra record (`/var/lib/headscale/extra-records.json`
-  on nh3-headscale, hot-reloaded) → 100.64.0.9. There is no public record and no internal AdGuard record.
+  on nh3-headscale, hot-reloaded) → 100.64.0.9. There is no public record. **Since 2026-10-08 (Prime: "internal name
  servers don't resolve svos.phasefinal.com") the three internal AdGuards (ana `10.250.50.70:8053`, esh `10.0.50.45`,
  nh3 `10.100.50.40`) also carry hand-made rewrites** `svos.phasefinal.com` and `svos-terminal.phasefinal.com` →
  `100.64.0.9`, outside `dns-sync.py`'s `.internal` authority, like `*.nh3.phasefinal.com`. The name now resolves
  everywhere, but only a **mesh client** can connect: LAN-only hosts at all three sites get `000` (no route to
  100.64.0.0/10), measured 10-08.
 - **TLS:** Caddy 2.11.4 (the fleet `caddy-cf` build with the Cloudflare DNS module) at `/usr/local/bin/caddy`, unit
  `caddy-svos.service`, config `/etc/caddy/Caddyfile` (canonical `configs/svos-front/Caddyfile`). It listens **only on
  100.64.0.9:443**, with no `:80`. The LE cert for `svos.phasefinal.com` comes via DNS-01, token `nh3-svos-caddy-dns01`