fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS #158

2026-11-09T02:46:45Z

gitea-admin commented

2026-11-09 02:46:45 +00:00

Enrols the phone's at-home WireGuard peer and lets tunnel clients use Pi-hole.

Needs the operator: conformance/** is a sensitive path, so approval-policy stays red until you post /approve-override <reason> as a PR review of type Comment. I have not posted it.

Changes

platform/vpn-ingress/peers.conf: adds keith-phone-home, 10.90.0.3/32.
apps/wave-0/pihole-dns.yaml: adds ${WG_CLIENT_CIDR} to loadBalancerSourceRanges on both DNS Services. This file is hand-written, not rendered, so --emit-waves was not run. catalog/pihole.yaml changes in one comment only.
New L0 guard pihole-dns-source-ranges: both ranges present, every range RFC1918. Seven mutations all fail as intended.
platform/vpn-ingress/README.md: corrects the SNAT and IPv6 claims, documents the home/away tunnels.

Rollout

peers.conf: the ConfigMap hash changes, so the DaemonSet rolls one node at a time and each node's wg0 is recreated. keith-phone has no session today, so nothing is interrupted.
Check after merge: run ip route get 1.1.1.1 on each node. wg0 churn cost all three nodes their default route on 2026-10-06, and Cilium's devices is still unpinned.
Service change: in place. Same VIP, no pod restart.

Gate

Pinned toolbox, on this commit: rc 3, not green. gitea-settings did not run (no local token), and conformance L2/L3 skipped as the declared no-cluster gap. All other stages passed; approval-policy is N/A offline.

Not verified

DROP_NOT_IN_SRC_RANGE and full-tunnel behaviour were not observed live. Only wg0's membership in Cilium's devices was measured.
No handshake has ever been recorded for any peer, so tunnel DNS and Gateway access are untested until the phone connects.

Details and flagged follow-ups: decisions/2026-11-08-wg-home-peer-pihole-sources.md. Merges cleanly with #157.

🤖 Generated with Claude Code

Enrols the phone's at-home WireGuard peer and lets tunnel clients use Pi-hole. **Needs the operator:** `conformance/**` is a sensitive path, so `approval-policy` stays red until you post `/approve-override <reason>` as a PR review of type Comment. I have not posted it. ## Changes - `platform/vpn-ingress/peers.conf`: adds `keith-phone-home`, `10.90.0.3/32`. - `apps/wave-0/pihole-dns.yaml`: adds `${WG_CLIENT_CIDR}` to `loadBalancerSourceRanges` on both DNS Services. This file is hand-written, not rendered, so `--emit-waves` was not run. `catalog/pihole.yaml` changes in one comment only. - New L0 guard `pihole-dns-source-ranges`: both ranges present, every range RFC1918. Seven mutations all fail as intended. - `platform/vpn-ingress/README.md`: corrects the SNAT and IPv6 claims, documents the home/away tunnels. ## Rollout - **peers.conf:** the ConfigMap hash changes, so the DaemonSet rolls one node at a time and each node's `wg0` is recreated. `keith-phone` has no session today, so nothing is interrupted. - **Check after merge:** run `ip route get 1.1.1.1` on each node. `wg0` churn cost all three nodes their default route on 2026-10-06, and Cilium's `devices` is still unpinned. - **Service change:** in place. Same VIP, no pod restart. ## Gate Pinned toolbox, on this commit: **rc 3, not green.** `gitea-settings` did not run (no local token), and `conformance` L2/L3 skipped as the declared no-cluster gap. All other stages passed; `approval-policy` is N/A offline. ## Not verified - `DROP_NOT_IN_SRC_RANGE` and full-tunnel behaviour were **not observed live**. Only `wg0`'s membership in Cilium's devices was measured. - **No handshake has ever been recorded for any peer**, so tunnel DNS and Gateway access are untested until the phone connects. Details and flagged follow-ups: `decisions/2026-11-08-wg-home-peer-pihole-sources.md`. Merges cleanly with #157. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-11-09 02:46:45 +00:00

fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS

gate / gate (pull_request) Successful in 1m12s

Details

gate / conformance (pull_request) Skipped

Details

f13d336630

Add the at-home peer (10.90.0.3) and list ${WG_CLIENT_CIDR} in the PiHole
DNS frontends' loadBalancerSourceRanges. wg0 is a Cilium device, so tunnel
clients reach the source-range check untranslated; a LAN-only list is
predicted to drop their DNS. Adds an L0 guard that both ranges are present
and every range is RFC1918, and corrects the README's SNAT and IPv6 claims.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

jakman85 scheduled this pull request to auto merge when all checks succeed 2026-11-09 02:48:37 +00:00

jakman85 approved these changes

2026-11-09 02:48:42 +00:00

jakman85 merged commit da0515c8c8 into main

2026-11-09 02:50:05 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#158