75ba9f005a
User-approved promotions from the prior compile's proposal list. pbs-hub-mcp deferred per user. Wiki domain indexes updated to list the new entities; Sources left untouched (MCP-written/immutable). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
46 lines
2.4 KiB
Markdown
46 lines
2.4 KiB
Markdown
---
|
|
type: entity
|
|
path: Wiki/Homelab
|
|
tags:
|
|
- dns
|
|
- proxmox
|
|
- homelab
|
|
- traefik
|
|
created: 2026-05-24
|
|
updated: 2026-05-24
|
|
---
|
|
|
|
# Knot DNS
|
|
|
|
## What it is
|
|
|
|
Knot is the authoritative DNS server for the homelab's internal `.herbylab.dev` zone, running in a Proxmox LXC. It is the primary half of a split-horizon DNS architecture — Knot answers authoritatively for internal names while Pi-hole sits in front for filtering and forwarding. Knot is what makes capability-based names like `traefik.herbylab.dev`, `pihole.herbylab.dev`, and `openwrt.herbylab.dev` resolve on the LAN to their Traefik-fronted services.
|
|
|
|
## Current state
|
|
|
|
Active as the internal authority. Operational notes from recent work:
|
|
- **Split-horizon** — Knot authoritative for internal `.herbylab.dev`; Pi-hole forwards/filters in front (rebind-protection and EDE-15 issues were debugged during stand-up)
|
|
- **A-records being added incrementally** as services land — outstanding adds flagged in session notes include `pve.herbylab.dev → 10.0.21.188` (so PVE SPICE `.vv` files stop needing sed-rewrite) and `us-test-authy.herbylab.dev → 10.0.21.207`
|
|
- Sits upstream of the homelab [[Wiki/Reference/traefik|Traefik]] TLS pipeline (DNS resolves the name, Traefik terminates with the `*.herbylab.dev` wildcard)
|
|
|
|
## Where it lives
|
|
|
|
- Knot LXC (container **103**) on Proxmox
|
|
- Zone data for `.herbylab.dev`; secondary on the NAS is a planned follow-on (not yet stood up)
|
|
|
|
## Related projects
|
|
|
|
- [[Sources/Homelab/dns-knot-pihole-end-to-end|dns-knot-pihole-end-to-end]] — Knot + Pi-hole chain live; rebind/EDE-15 fixes
|
|
- [[Sources/Homelab/homelab-dns-decision|homelab-dns-decision]] — locked split-horizon Knot architecture
|
|
- [[Sources/Homelab/2026-05-21-traefik-routes-for-pihole-openwrt-us-test-authy-static-ip-cutove|traefik routes for pihole/openwrt]] — internal name resolution for new routes
|
|
- [[Wiki/Reference/traefik|traefik]] — consumes Knot resolution
|
|
- [[Wiki/Homelab/proxmox|proxmox]] — host
|
|
- [[Wiki/Homelab/homelab-ingress-stack|homelab-ingress-stack]] — synthesis
|
|
|
|
## History
|
|
|
|
- **2026** — Split-horizon Knot architecture locked; `.herbylab.dev` authoritative internally
|
|
- **2026** — Knot + Pi-hole chain brought live end-to-end (rebind protection + EDE-15 debugging)
|
|
- **2026-05** — Pending A-record adds (`pve`, `us-test-authy`) flagged across Traefik/PBS-backup sessions
|
|
- **Planned** — Knot zone file into git; Ansible role for the primary; secondary on NAS
|