next ai changes

README.md

@@ -10,7 +10,7 @@ Oswald↔Trochalakis tunnel — this box never carries it.
  roaming client ══ovpn══▶ │ tun0 172.31.8.1                          │
  (172.31.8.x)             │   openvpn ─▶ duo-authproxy ─▶ Duo cloud  │
    DNS/routes pushed      │      (127.0.0.1:1812)   └──LDAPS 636──┐  │
-                          │   unbound 127.0.0.1 / .8.1 / .255.1   │  │
+                          │   technitium :53 / console :5380      │  │
                           │ wg0 172.31.255.1 ─────────────────────┼──┤
                           └──────────┬──────────────────┬─────────┘  │
                             wg   .255.2            wg .255.3     (via wg0)
@@ -28,20 +28,31 @@ Oswald↔Trochalakis tunnel — this box never carries it.
 | OpenVPN clients      | `172.31.8.0/24`   | routed (not NATed) to both sites |
 
 Public endpoint: `vpn.atlashorizon.net` — only 22/tcp (SSH), 51820/udp
-(WireGuard) and 1194/udp (OpenVPN) are open; DNS/RADIUS/mgmt bind to
-loopback and tunnel IPs only.
+(WireGuard) and 1194/udp (OpenVPN) are open. RADIUS binds loopback only;
+Technitium's DNS (:53) and web console (:5380) are firewalled to the
+tunnels and additionally guarded by its recursion ACL.
 
 ## Layout
 
-- [docker-compose.yml](docker-compose.yml) — openvpn, duo-authproxy, unbound (all `network_mode: host`)
+- [docker-compose.yml](docker-compose.yml) — openvpn, duo-authproxy, technitium (all `network_mode: host`)
 - [openvpn/](openvpn/) — server.conf, PAM→RADIUS glue, offline-CA workflow in [pki/README.md](openvpn/pki/README.md)
 - [duo-authproxy/](duo-authproxy/) — built from Duo's source tarball; cfg rendered from `.env`
-- [unbound/](unbound/) — conditional forwarder: AD zones → DCs over wg0, everything else public recursion
+- [technitium/](technitium/) — Technitium DNS: AD conditional-forwarder zones created by an idempotent API init job ([configure.sh](technitium/configure.sh)), everything else public recursion; web console on :5380 (VPN/tunnel only)
 - [host/](host/) — `setup.sh` (sysctl, iptables, wg keygen), `wg0.conf.example`, firewall template
 - [client/](client/) — `.ovpn` template for end users
+- [ansible/](ansible/) — one idempotent playbook for setup **and** updates, deploys to `/opt/<service>` (see [ansible/README.md](ansible/README.md))
 - [docs/](docs/) — [SITE-SIDE.md](docs/SITE-SIDE.md) (DC/firewall work at the sites), [TESTPLAN.md](docs/TESTPLAN.md)
 
-## Deploy order
+## Deploy: Ansible (preferred)
+
+`ansible/site.yml` does everything in the manual list below — Docker
+install, sysctl, firewall, WireGuard keygen, and the compose stack under
+`/opt` — and re-running it is the update mechanism. See
+[ansible/README.md](ansible/README.md). Site-side work
+([docs/SITE-SIDE.md](docs/SITE-SIDE.md)) and the offline CA stay manual
+either way.
+
+## Deploy: manual
 
 1. **Host**: `sudo host/setup.sh` — installs wireguard + iptables rules,
    generates the WG key, prints the public key for the sites.
@@ -68,6 +79,15 @@ loopback and tunnel IPs only.
   LAN; the sites' RackNerd peer only carries `172.31.8.0/24` + the hub IP.
 - **MTU**: OpenVPN `tun-mtu 1400` / `mssfix 1360` keeps client packets
   inside wg0's 1420 so nothing fragments on the middle leg.
+- **Technitium is stateful**: `DNS_SERVER_*` env vars seed config on the
+  *first* start only; after that its state lives in
+  `/opt/technitium/config` (persists `down`/`up`, backed up like data).
+  The init job only creates *missing* forwarder zones — console edits are
+  never overwritten. Changed a DC IP in `.env`? Delete the zone in the
+  console and rerun `docker compose up technitium-init`.
+- **Port 53 on the host**: systemd-resolved's stub listener is disabled
+  (setup.sh/Ansible) — Technitium binds wildcard :53 and would collide;
+  `/etc/resolv.conf` is repointed at resolved's upstream file.
 - **Duo flow**: password → push; `password,passcode` → offline fallback
   (`allow_concat=true`). `reneg-sec 0` + `auth-gen-token` prevent surprise
   re-prompts mid-session. `failmode=safe` fails *open* if Duo cloud is
@@ -76,4 +96,7 @@ loopback and tunnel IPs only.
   server instance (`proto tcp4`, `port 443`, separate `dev tun1` +
   firewall rule). Not enabled by default.
 - **Firewall reloads**: `netfilter-persistent reload` flushes Docker's
-  chains — restart docker afterwards (setup.sh does this).
+  chains — restart docker afterwards (setup.sh/Ansible handler do this).
+- **IPv6 is locked down too**: [host/rules.v6.template](host/rules.v6.template)
+  default-drops the public v6 address (SSH/WG/OpenVPN only, ICMPv6
+  allowed) since Technitium and the console bind dual-stack wildcard.