Frank
4b82f35354
Tracked the harness artifacts accumulated on blankpad (blank@), matching the existing convention for the --home-dank-* memory stores and the 36 already-tracked managed-skills. managed-skills (9): authentik-proxy-provider-app-link, dankclaw-guard-chain-layer-diagnosis, e2e-arr-rawip-reachability-triage, halogen-kv-pool-fit, lan-client-split-dns-fix, noctalia-reference, rootless-quadlet-log-retrieval, ssh-key-bootstrap-no-sshpass, swapfile-resize-safe-ordering. memories (2 stores): --home-blank-.omp-- (dotfiles_git, handy_lifecycle, input_permissions) and --home-blank-Projects-serverAppConfig-- (frank_large_quadlet). Secret sweep before staging: no PEM blocks, no credential literals. Content is fleet topology/IPs only, same class as the tracked dank stores.
1.9 KiB
name, description
| name | description |
|---|---|
| lan-client-split-dns-fix | Fix a LAN client timing out on *.franksdank.cloud because it resolves the public WAN IP (no 443 forward) instead of the Pi-hole LAN answer; diagnose by resolver and fix with a systemd-resolved route-only drop-in. |
LAN client split-DNS fix (*.franksdank.cloud)
Symptom: a LAN machine gets connection timeout (curl rc=28) on https://*.franksdank.cloud, or LAN-only names return NXDOMAIN, while the server is actually healthy.
Root cause
Public DNS for franksdank.cloud = WAN IP 71.227.227.172, which has no 443 port-forward (filtered). Pi-hole 192.168.0.143 returns the LAN answer 192.168.0.143 via addn-hosts. If the client's resolver is using an external server (1.1.1.1/quad9), it gets the WAN answer → SYN to a filtered port → timeout.
Diagnose (fast)
dig +short www.franksdank.cloud @192.168.0.143 # expect 192.168.0.143
dig +short www.franksdank.cloud @1.1.1.1 # expect 71.227.227.172 (the trap)
resolvectl status | grep -iE 'Current DNS|DNS Server' # which server is active?
# prove the server is fine by pinning the LAN IP:
curl -sk --resolve www.franksdank.cloud:443:192.168.0.143 https://www.franksdank.cloud/ -o /dev/null -w '%{http_code}\n' # 200
Fix (systemd-resolved route-only drop-in)
sudo mkdir -p /etc/systemd/resolved.conf.d
sudo tee /etc/systemd/resolved.conf.d/franksdank-lan.conf >/dev/null <<'EOF'
[Resolve]
DNS=192.168.0.143
Domains=~franksdank.cloud ~franksdank.casa
EOF
sudo systemctl restart systemd-resolved
resolvectl flush-caches
The ~ (route-only) prefix sends *.franksdank.cloud ONLY to Pi-hole and never to the default-route servers. Verify: getent hosts www.franksdank.cloud → 192.168.0.143.
Note
This is a per-client fix. Every LAN client that must reach the homelab by name needs Pi-hole as its DNS (or this drop-in). The server side needs no change.