Repository navigation
Work out DNS for the MokerLink management UI #97
Description
The MokerLink management UI is reached by IP (10.7.7.2). Everything else with
a web interface has, or will have, a name.
Two reasons this is more than cosmetic:
- The lab CA issues certificates for names, not addresses
(gen-certs.sh,grafana.matrix.elysium). A switch reached by IP cannot be
given a certificate that verifies, so it stays on plain HTTP or on a warning
page people learn to click through. 10.7.7.2is on a different subnet from every other management address
(10.0.99.x), which is easy to typo and easy to forget.
ADR-0008 proposes AdGuard Home on the sensitive tier, which would be the natural
place for this — so this may be blocked behind that, or may be worth solving
sooner with hosts entries or a pfSense DNS override.
Tracked in docs/roadmap.md; filed as an issue so it has a place to be discussed and closed.
Activity
Merge pull request #259 from Gerrrt/gerrrt/mokerlink-dns-setup-1f7f1b
docs(roadmap): move #97 to Done — it was closed before the entry was …
Gerrrt commentedon Sep 4, 2026
Evidence for the record, 2026-09-04
Closed without a comment, so the verification that backs it was only in
docs/roadmap.md. Putting it on the issue. Gathered while checking the DNS baseline for #123 — nothing here changes the outcome, it just records it.The granted half works
neo→10.7.7.2is one of six.matrix.elysiumhost overrides on Unbound, read offmorpheusdirectly. Both blackbox targets probe green from the running exporter:probe_successprobe_http_status_codeprobe_dns_lookup_time_secondshttp://neo.matrix.elysium/http://10.7.7.2/The
via: dnstwin is what makes the pair worth having: both failing means the switch UI is down, only the named one failing means the UI is up and the override is gone. That distinction matters more here than anywhere else intargets/blackbox.yaml, because10.7.7.2is the one management address on a different subnet from every other.The override was never blocked behind ADR-0008, which is what this issue originally suspected it might be — ADR-0010 keeps the host overrides on Unbound whatever AdGuard ends up doing, and the six above are the proof.
The certificate half stays unavailable
Unchanged and not pending: the switch has no TLS listener and no way to import a certificate, so the lab CA has nothing to issue for. It does not answer on 443 at all — the connection is dropped, checked from
10.0.99.20.http_2xx_plainis therefore the permanent module for this target rather than a placeholder, which is what ADR-0018 decided.That is the third firmware limit on this device after #84 and #85, and the argument for where TLS management belongs in the criteria when it gets replaced.
Housekeeping
docs/roadmap.mdstill listed the granted half as outstanding work a day after this issue was closed. #285 moves the entry to Done with the evidence above.Merge origin/main into gerrrt/confirm-snort-removed-105