Repository navigation
docs(adr): verify ADR-0010 against the running config (#123) - #285
Merged
Merged
Conversation
#123's remaining scope was to confirm the DNS baseline before anyone implements #125, because everything both documents rest on came from Lemmiwinks pages nine months stale. Read off `morpheus` on 2026-09-04. The decision holds. Two of the facts underneath it do not. Unbound forwards to nothing: `validator iterator`, an auto-trust-anchor file and zero forward-zone blocks, so it recurses from the root and validates DNSSEC. The public addresses in General Setup are the firewall's own fallback in its resolv.conf, below 127.0.0.1, with both override checkboxes unticked — no client query has ever reached them. So "the existing public upstreams" the ADR says to keep beside AdGuard are not a forwarder list to prepend to, and implementing it is a resolution-mode change that hands a query stream currently seen by no third party to AdGuard, Cloudflare and Google. One client bypasses all of it: every enabled scope hands out pfSense, but a static map inside Hicks gives Mekenna's work laptop 8.8.8.8 and 9.9.9.9. It reads as deliberate and nothing here changes it — recorded because "clients only ever have one resolver" is the premise the decision rests on and there is exactly one exception. Also closes out two stale roadmap claims found on the way: #97's granted half is done (the `neo` override exists and its dns twin probes green), and #102 now carries the larger implementation cost. #123's own entry lands under Monitoring — the AdGuard-loss probe must query AdGuard directly, since one through the normal path always passes, and it is blocked on #102 rather than writable today. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…written The entry claimed the granted half was outstanding, then claimed it was done but still needed closing. Both were wrong: #97 was closed as completed on 2026-09-04 at 04:05 UTC, hours before the verification that "found" it. Moved to Done in the section's own format, with the evidence kept and the staleness named. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This was referenced Sep 4, 2026
7 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the verification half of #123. Everything ADR-0010 and #125 rest on came from
Gerrrt/Lemmiwinkspages the issue itself flagged as nine months stale and self-inconsistent. Read offmorpheuson 2026-09-04.The decision holds. Two of the facts underneath it do not.
Unbound forwards to nothing at all
/var/unbound/unbound.conf:module-config: "validator iterator", anauto-trust-anchor-file, zeroforward-zoneblocks. It recurses from the root and validates DNSSEC. The8.8.8.8/1.1.1.1in General Setup are the firewall's own fallback — below127.0.0.1in its/etc/resolv.conf, with DNS Server Override and Use local DNS both unchecked — and no client query has ever reached them.So "the existing public upstreams", which ADR-0010 says to keep listed alongside AdGuard, are not a forwarder list waiting to be prepended to. Implementing it is a resolution-mode change, and it hands a query stream that currently reaches no third party to AdGuard, Cloudflare and Google. Worth accepting deliberately rather than as a side effect of ticking Enable Forwarding Mode. Two knock-ons the ADR did not consider: DNSSEC validation is on, so a forwarder that strips records turns signed zones into SERVFAIL; and the graceful fallback the entire decision turns on has never run here, because there is no forwarder that can fail.
One client bypasses all of it
Every enabled scope hands out pfSense — five implicitly, Hicks by naming
10.0.50.1, the same address. One static map inside Hicks overrides it:Mekenna-Laptop— "Mekenna's Work Laptop"10.0.50.698.8.8.8,9.9.9.9Never reaches Unbound, so it will never be filtered and cannot resolve
matrix.elysiumat all. Reads as deliberate and nothing here changes it — recorded because clients only ever have one resolver, so they cannot select around the filter is the premise the decision rests on, and there is exactly one exception.Confirmed as documented
Six host overrides; no domain overrides;
resolvectl statusonprometheusshows the single resolver10.0.99.1. The wiki really is on10.0.99.30alongsideoracle— both the name and the address answer 200 from the running exporter — settling the inconsistency #123 raised.Roadmap
neo→10.7.7.2override exists and thevia: dnstwin probes green. Nothing left but closing it.Docs only.
make lintandmake check-docspass. What is left on #123 is one line in the Lemmiwinks family runbook, outside this repository.🤖 Generated with Claude Code