next ai changes

docs/SITE-SIDE.md

@@ -47,7 +47,7 @@ AD client ports — DNS 53, Kerberos 88/464, LDAP 389/636, SMB 445, RPC 135 +
 49152-65535, NTP 123, GC 3268/3269.
 
 Allow from **`172.31.255.1/32`** (the RackNerd host itself):
-- TCP/UDP 53 → AHDC01, AHDC03, AH-OSWLDC (Unbound forwarder queries)
+- TCP/UDP 53 → AHDC01, AHDC03, AH-OSWLDC (Technitium forwarder queries)
 - TCP 636 → AHDC01, AHDC03 (Duo Auth Proxy LDAPS)
 
 ## 4. Active Directory

docs/TESTPLAN.md

@@ -13,10 +13,10 @@ ping -c3 <TROCH_DC1_IP>             # AHDC01 across the tunnel
 ping -c3 <OSWALD_DC_IP>             # AH-OSWLDC across the tunnel
 ```
 
-## 1. Unbound (on the VPS)
+## 1. Technitium DNS (on the VPS)
 
 ```bash
-docker compose ps unbound           # healthy
+docker compose logs technitium-init  # "Technitium AD forwarder zones OK."
 # AD SRV record via conditional forward (the money query):
 dig @127.0.0.1 _ldap._tcp.dc._msdcs.ad.atlashorizon.net SRV +short
 dig @127.0.0.1 ahdc01.ad.atlashorizon.net +short
@@ -25,6 +25,10 @@ dig @127.0.0.1 -x <TROCH_DC1_IP> +short          # reverse zone
 dig @127.0.0.1 google.com +short                  # public recursion
 ```
 
+Web console: from a VPN client or site host, `http://172.31.8.1:5380`
+(or `http://172.31.255.1:5380` over the site tunnels) — verify the six
+conditional-forwarder zones exist. Must NOT load from the public IP.
+
 ## 2. Duo Auth Proxy (on the VPS)
 
 ```bash
@@ -68,12 +72,16 @@ This stage proves the **LDAP bind** leg independently of OpenVPN.
 
 ```bash
 nmap -sU -p 53,1194,51820 <racknerd_public_ip>   # 53 must NOT respond
-nmap -sT -p 22,53,636,1812,7505 <racknerd_public_ip>  # only 22 open
+nmap -sT -p 22,53,636,1812,5380,7505 <racknerd_public_ip>  # only 22 open
+# If the VPS has a public IPv6 address, repeat over v6:
+nmap -6 -sT -p 22,53,5380 <racknerd_public_ipv6>          # only 22 open
 ```
 
 ## 6. Persistence
 
 ```bash
 docker compose down && docker compose up -d --build   # survives cleanly
+# Technitium zones must still exist afterwards (state in /opt/technitium/config)
+dig @127.0.0.1 _ldap._tcp.dc._msdcs.ad.atlashorizon.net SRV +short
 reboot   # then: wg show, docker compose ps, re-run stage 3 quick connect
 ```