2026-07-08 23:45:47 +00:00
1 changed files with 13 additions and 0 deletions
@@ -12,6 +12,19 @@ locals {

    # Talos K8s control-plane VIP (etcd-elected, see kubernetes/talos/patches/k8s-{1,2,3}.yaml)
    "k8s" = { type = "A", value = "10.2.40.60" }
+
+    # AAAA Records
+    # UniFi auto-creates only the A record for the UDM's own hostname
+    # (udm -> 192.168.8.1) and forwards AAAA queries upstream, where the
+    # *.renner.uno wildcard answers with proxy.renner.uno (the public
+    # reverse proxy). IPv6-first clients — notably Home Assistant's UniFi
+    # Network integration — then connect to the proxy, which rejects the
+    # unknown SNI with `tlsv1 alert internal error`, flapping the
+    # integration into setup_error. Pin the AAAA to the UDM's own
+    # management ULA (fd00::1, serves the controller cert CN=udm.renner.uno
+    # and is reachable from the cluster via its v6 default route) so v6
+    # resolution stays local instead of falling through to the proxy.
+    "udm" = { type = "AAAA", value = "fd00::1" }
  }
 }