konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

Add AAAA for udm.renner.uno (fixes flapping UniFi integration in HA) #133

Merged
k.renner merged 1 commits from feat/udm-aaaa-record into master 2026-07-08 23:45:47 +00:00
Conversation 0 Commits 1 Files Changed 1
+13
1 Commits
Author SHA1 Message Date
k.rennerandClaude Opus 4.8 42be3a8f29 fix(dns): add AAAA for udm.renner.uno so HA's UniFi integration stops flapping
ci/woodpecker/push/deploy-infrastructure Pipeline was successful
Details 
The UniFi Network integration in Home Assistant intermittently drops to
setup_error with:
  Cannot connect to host udm.renner.uno:443 ... TLSV1_ALERT_INTERNAL_ERROR

Root cause is IPv6, not TLS or the UDM. UniFi auto-generates only the A
record for the UDM's own hostname (udm -> 192.168.8.1) and forwards AAAA
queries to its upstream, where the *.renner.uno wildcard answers with
proxy.renner.uno (the public NetBird reverse proxy). HA is IPv6-first, so
it resolves udm.renner.uno to the proxy over v6 and gets its handshake
rejected (unknown SNI -> tlsv1 alert internal error). The integration
recovers only when resolution happens to land on the working A path.

Pin an explicit AAAA to the UDM's own management ULA fd00::1:
- verified serving the controller (cert CN=udm.renner.uno),
- a ULA, so it doesn't rotate like the ISP 2003:d6:* GUAs,
- reachable from the cluster via the node v6 default route (UDM ll gw).

With a local AAAA present, UniFi answers it itself instead of forwarding
upstream, so v6-first clients reach the controller. Because the record
matches the cert CN, TLS verification also passes.

Applied via the unifi_dns_record resource (UniFi local DNS) on tofu apply.
Watch the apply: if the UniFi provider/UDM rejects AAAA record types, this
is the point it surfaces.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
 2026-07-09 01:44:22 +02:00