chore(dns): drop the stale UDM records pointing at the retired Hetzner VM #497

2026-08-16T20:44:00Z

claude-bot commented

2026-08-16 20:44:00 +00:00

renner.uno and www.renner.uno were pinned to 159.69.42.237 — the VM that hosted WordPress before the migration in #492.

Neither record is live on the UDM any more (verified: a LAN query for www.renner.uno returns the public answer, proxy.renner.uno), so this block was drift waiting to be re-applied. A tofu apply would have pointed the house at a host that is being decommissioned, while the rest of the world already reaches the cluster — a split-brain that does not exist today and should not be re-created.

Their absence is the correct end state, not an omission: www.renner.uno carries dns.renner.uno/public, so external-dns-unifi deliberately writes no UDM record and LAN clients follow the public path (wildcard → proxy) and hairpin back in.

Cutover state, measured


`www.renner.uno` (authoritative)	CNAME → `proxy.renner.uno` → 45.157.177.26 + IPv6
via the proxy	HTTP 200, cert `CN=www.renner.uno`, Let's Encrypt
unlisted SNI (negative control)	`CN=TRAEFIK DEFAULT CERT`, self-signed
`renner.uno`	301 → `https://www.renner.uno/` (Cloudflare redirect rule)
`/wp-admin`	302 → Authentik, login form reachable (4 hops)

Known gap, not in this PR: the redirect rule drops the query string, so renner.uno/?p=67 lands on the homepage instead of the post. Fixed by enabling Preserve query string on the rule.

🤖 Generated with Claude Code

https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98

`renner.uno` and `www.renner.uno` were pinned to `159.69.42.237` — the VM that hosted WordPress before the migration in #492. Neither record is live on the UDM any more (verified: a LAN query for `www.renner.uno` returns the public answer, `proxy.renner.uno`), so this block was drift waiting to be re-applied. A `tofu apply` would have pointed the house at a host that is being decommissioned, while the rest of the world already reaches the cluster — a split-brain that does not exist today and should not be re-created. Their absence is the correct end state, not an omission: `www.renner.uno` carries `dns.renner.uno/public`, so external-dns-unifi deliberately writes no UDM record and LAN clients follow the public path (wildcard → proxy) and hairpin back in. ## Cutover state, measured | | | |---|---| | `www.renner.uno` (authoritative) | CNAME → `proxy.renner.uno` → 45.157.177.26 + IPv6 | | via the proxy | HTTP 200, cert `CN=www.renner.uno`, Let's Encrypt | | unlisted SNI (negative control) | `CN=TRAEFIK DEFAULT CERT`, self-signed | | `renner.uno` | 301 → `https://www.renner.uno/` (Cloudflare redirect rule) | | `/wp-admin` | 302 → Authentik, login form reachable (4 hops) | **Known gap, not in this PR:** the redirect rule drops the query string, so `renner.uno/?p=67` lands on the homepage instead of the post. Fixed by enabling *Preserve query string* on the rule. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98

claude-bot added 1 commit 2026-08-16 20:44:00 +00:00

chore(dns): drop the stale UDM records pointing at the retired Hetzner VM

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

0211269b91

renner.uno and www.renner.uno were pinned to 159.69.42.237, the VM that hosted
WordPress before it moved into the cluster. Neither record is live on the UDM
any more (verified: a LAN query for www.renner.uno returns the public answer,
proxy.renner.uno), so the file was drift waiting to be re-applied — a tofu
apply would have pointed the house at a host that is being decommissioned,
while the rest of the world already reaches the cluster.

Their absence is the correct end state, not an omission: www.renner.uno
carries dns.renner.uno/public, so external-dns-unifi writes no UDM record by
design and LAN clients take the public path and hairpin back in. The apex
stays with Cloudflare, which now redirects renner.uno/* to www.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014giKN9N6e5J2DF8QZmVh98

review-bot reviewed

2026-08-16 20:46:49 +00:00

review-bot left a comment

🤖 Automated review — model claude-sonnet-5 (complexity: normal), commit 0211269b9109566762e7fc8fd44976b100af9d24.

Advisory review by the review-bot pipeline. It never approves; a human merges. Push new commits to get a fresh review.

Summary

This PR removes the "@" (apex) and "www" A records from opentofu/dns_renner_uno.tf (local.renner_uno_records), which pinned renner.uno/www.renner.uno to 159.69.42.237, the retired Hetzner VM. It's a one-file, comment-heavy terraform change with no logic beyond deleting a map entry and no blocking issues.

I verified the supporting claims against the rest of the repo rather than taking them on faith:

kubernetes/apps/wordpress/ingress.yaml:18 confirms www.renner.uno is served by an Ingress labeled dns.renner.uno/public: "true".
kubernetes/infrastructure/external-dns-unifi/helmrelease.yaml:103 confirms external-dns-unifi runs with labelFilter: dns.renner.uno/public!=true, i.e. it deliberately skips writing a UDM record for anything labeled public — consistent with the "external-dns-unifi writes no UDM record for www" claim.
opentofu/unifi_nat_hairpin.tf implements the hairpin DNAT that lets LAN clients on the Default network (idx 0, included in hairpin_networks) reach proxy.renner.uno's public addresses without leaving the LAN — this is what makes "LAN clients follow the public path and hairpin back in" true rather than just plausible, and matches the AAAA-fallback comments already in the same file for udm/captive.
No other file in the repo references 159.69.42.237 or otherwise depends on the removed "@"/"www" map keys (opentofu/scripts/import_dns.py's renner_uno_records hit is a generic resource-address regex, not tied to specific keys).

The one claim I could not verify from the checkout is the apex behavior ("renner.uno → 301 → https://www.renner.uno/ via a Cloudflare redirect rule") — that configuration lives outside this repo. The PR body states it was measured directly, which is reasonable for a repo that has no Cloudflare IaC to check against.

🟡 Suggestions

The comment block (opentofu/dns_renner_uno.tf:3-17) is fairly long for a "why this is absent" note, but it's consistent with this file's existing style (the udm/captive AAAA comments a few lines down are similarly long), so I wouldn't ask for a trim.

Tests

No automated test covers this repo's opentofu/ DNS records (ci-manifests-test.yml is path-filtered to kubernetes/** and .woodpecker/**, so it doesn't run on this diff), and a tofu plan/apply isn't something I can execute here. That's consistent with how the rest of this file is maintained — the correctness case rests on the LAN queries described in the PR body, which I can't reproduce from this checkout. Nothing about that gap is specific to this PR.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-sonnet-5` (complexity: normal), commit `0211269b9109566762e7fc8fd44976b100af9d24`. > Advisory review by the `review-bot` pipeline. It never approves; a human merges. Push new commits to get a fresh review. --- ## Summary This PR removes the `"@"` (apex) and `"www"` A records from `opentofu/dns_renner_uno.tf` (`local.renner_uno_records`), which pinned `renner.uno`/`www.renner.uno` to `159.69.42.237`, the retired Hetzner VM. It's a one-file, comment-heavy terraform change with no logic beyond deleting a map entry and no blocking issues. I verified the supporting claims against the rest of the repo rather than taking them on faith: - `kubernetes/apps/wordpress/ingress.yaml:18` confirms `www.renner.uno` is served by an Ingress labeled `dns.renner.uno/public: "true"`. - `kubernetes/infrastructure/external-dns-unifi/helmrelease.yaml:103` confirms `external-dns-unifi` runs with `labelFilter: dns.renner.uno/public!=true`, i.e. it deliberately skips writing a UDM record for anything labeled public — consistent with the "external-dns-unifi writes no UDM record for www" claim. - `opentofu/unifi_nat_hairpin.tf` implements the hairpin DNAT that lets LAN clients on the `Default` network (idx 0, included in `hairpin_networks`) reach `proxy.renner.uno`'s public addresses without leaving the LAN — this is what makes "LAN clients follow the public path and hairpin back in" true rather than just plausible, and matches the AAAA-fallback comments already in the same file for `udm`/`captive`. - No other file in the repo references `159.69.42.237` or otherwise depends on the removed `"@"`/`"www"` map keys (`opentofu/scripts/import_dns.py`'s `renner_uno_records` hit is a generic resource-address regex, not tied to specific keys). The one claim I could *not* verify from the checkout is the apex behavior ("`renner.uno` → 301 → `https://www.renner.uno/` via a Cloudflare redirect rule") — that configuration lives outside this repo. The PR body states it was measured directly, which is reasonable for a repo that has no Cloudflare IaC to check against. ## 🟡 Suggestions - The comment block (`opentofu/dns_renner_uno.tf:3-17`) is fairly long for a "why this is absent" note, but it's consistent with this file's existing style (the `udm`/`captive` AAAA comments a few lines down are similarly long), so I wouldn't ask for a trim. ## Tests No automated test covers this repo's `opentofu/` DNS records (`ci-manifests-test.yml` is path-filtered to `kubernetes/**` and `.woodpecker/**`, so it doesn't run on this diff), and a `tofu plan`/`apply` isn't something I can execute here. That's consistent with how the rest of this file is maintained — the correctness case rests on the LAN queries described in the PR body, which I can't reproduce from this checkout. Nothing about that gap is specific to this PR. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit bb136e30b3 into master

2026-08-16 21:15:07 +00:00

k.renner referenced this issue from a commit

2026-08-16 21:15:07 +00:00

Merge pull request 'chore(dns): drop the stale UDM records pointing at the retired Hetzner VM' (#497) from drop-stale-hetzner-dns into master

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#497