From 42be3a8f297fa512a4f1dfb2cf916784a99ef6c1 Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Thu, 9 Jul 2026 01:44:22 +0200 Subject: [PATCH] fix(dns): add AAAA for udm.renner.uno so HA's UniFi integration stops flapping The UniFi Network integration in Home Assistant intermittently drops to setup_error with: Cannot connect to host udm.renner.uno:443 ... TLSV1_ALERT_INTERNAL_ERROR Root cause is IPv6, not TLS or the UDM. UniFi auto-generates only the A record for the UDM's own hostname (udm -> 192.168.8.1) and forwards AAAA queries to its upstream, where the *.renner.uno wildcard answers with proxy.renner.uno (the public NetBird reverse proxy). HA is IPv6-first, so it resolves udm.renner.uno to the proxy over v6 and gets its handshake rejected (unknown SNI -> tlsv1 alert internal error). The integration recovers only when resolution happens to land on the working A path. Pin an explicit AAAA to the UDM's own management ULA fd00::1: - verified serving the controller (cert CN=udm.renner.uno), - a ULA, so it doesn't rotate like the ISP 2003:d6:* GUAs, - reachable from the cluster via the node v6 default route (UDM ll gw). With a local AAAA present, UniFi answers it itself instead of forwarding upstream, so v6-first clients reach the controller. Because the record matches the cert CN, TLS verification also passes. Applied via the unifi_dns_record resource (UniFi local DNS) on tofu apply. Watch the apply: if the UniFi provider/UDM rejects AAAA record types, this is the point it surfaces. Co-Authored-By: Claude Opus 4.8 (1M context) --- opentofu/dns_renner_uno.tf | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/opentofu/dns_renner_uno.tf b/opentofu/dns_renner_uno.tf index 90f64722..ed550447 100644 --- a/opentofu/dns_renner_uno.tf +++ b/opentofu/dns_renner_uno.tf @@ -12,6 +12,19 @@ locals { # Talos K8s control-plane VIP (etcd-elected, see kubernetes/talos/patches/k8s-{1,2,3}.yaml) "k8s" = { type = "A", value = "10.2.40.60" } + + # AAAA Records + # UniFi auto-creates only the A record for the UDM's own hostname + # (udm -> 192.168.8.1) and forwards AAAA queries upstream, where the + # *.renner.uno wildcard answers with proxy.renner.uno (the public + # reverse proxy). IPv6-first clients — notably Home Assistant's UniFi + # Network integration — then connect to the proxy, which rejects the + # unknown SNI with `tlsv1 alert internal error`, flapping the + # integration into setup_error. Pin the AAAA to the UDM's own + # management ULA (fd00::1, serves the controller cert CN=udm.renner.uno + # and is reachable from the cluster via its v6 default route) so v6 + # resolution stays local instead of falling through to the proxy. + "udm" = { type = "AAAA", value = "fd00::1" } } } -- 2.54.0