DHCP and IPAM Operations

Address management combines a design registry with runtime state. The vault defines intended ownership, while OPNsense, the bootstrap gateway, and endpoint configuration prove which system currently owns each address.

Phase-Aware Ownership

Site A currently uses the UCG-backed 192.168.0.0/23 bootstrap network. Final OPNsense client scopes begin in A4. Do not expect final leases before their gate passes, and never bridge the bootstrap and target fabrics.

Assignment Ownership

Network or phase	Assignment owner	Method
Site A bootstrap `192.168.0.0/23`	UCG Max	Temporary DHCP/reservations plus documented static management and IPMI addresses; XG6 p4 serves one endpoint at a time
A3 switch commissioning on VLAN 10	OPNsense	Short-lived VLAN-10-only scope only if factory-default discovery requires it; remove before Gate A3
Final VLANs 10/20/25/30/40/50/60/70/80/90	Vault registry plus endpoint configuration	Static or application-managed assignment; no broad DHCP pool
Final VLANs 100/110/120	OPNsense	Client DHCP with documented reservations where needed
VLANs 65/999 at Site A	None	VLAN 65 is reserved and not carried; VLAN 999 has no IP service
Site B	Existing documented owners	Parked; Site A work does not change its scopes or reservations

Site A Client Scopes

VLAN	Pool	Gateway	DNS during A4-A9	DNS after A10
100	`10.10.100.50-10.10.103.199`	`10.10.100.1`	`10.10.100.1`	`10.10.30.10`, `10.10.30.11`
110	`10.10.110.50-10.10.110.199`	`10.10.110.1`	`10.10.110.1`	`10.10.30.10`, `10.10.30.11`
120	`10.10.120.50-10.10.120.199`	`10.10.120.1`	`10.10.120.1`	`10.10.30.10`, `10.10.30.11`

Infrastructure assignments follow Address Allocation Rules. Exact entries in IP Tables override a shorthand band.

Durable Address Record

Field	Required value
System and interface	Canonical hostname plus NIC, VM vNIC, BMC, or service interface
Site and VLAN	Site A/Site B and VLAN ID or bootstrap network
Address	IP with CIDR; gateway only where routed
Assignment type	Static, DHCP reservation, dynamic lease, VIP, or reserved/unallocated
MAC address	Required for a reservation; re-verify after VM replacement
Lifecycle phase	Bootstrap, A3 commissioning, final, or parked Site B
DNS	Forward/PTR record or explicit reason none exists
Owner and purpose	Workload or infrastructure owner and a short reason

The vault is the design authority. The active DHCP server and endpoint configuration are runtime authorities. A completed assignment leaves all three in agreement.

Allocation Workflow

Select the site, VLAN, and routing class from VLANs and Routing.
Check IP Tables for an existing assignment or reservation.
Search the repository for the proposed IP, hostname, and MAC.
Inspect the owning DHCP server's leases, reservations, exclusions, and stored client references.
Choose the documented role band or an existing explicit exception; never infer availability from the last octet alone.
Record the assignment in the vault before or with the runtime change.
Apply one assignment and verify address, mask, gateway, DNS, and expected reachability from the intended VLAN.
Add or update forward and PTR records when the DNS phase requires them.
Reconcile the lease and reservation view after the endpoint restarts.

Conflict-Prevention Rules

Never allocate an address found in the vault registry, active leases, reservations, VIP pools, or a device's fixed-IP configuration.
Keep infrastructure static addresses outside broad client lease ownership unless an explicit reservation and exclusion make ownership unambiguous.
Never run a broad DHCP scope on VLANs 10, 20, 25, 30, 40, 50, 60, 70, 80, or 90.
Remove the A3 VLAN 10 commissioning scope before Gate A3 closes.
Never provide DHCP or a gateway on VLANs 25, 60, 65, or 999 at Site A.
Preserve 10.10.253.0/24 as retired/reserved.
Never give the UCG a downstream VLAN 100 reservation during the Site A migration.

Reservation Lifecycle

A reservation couples an IP to a MAC, not a hostname. A Proxmox VM replacement can create a new MAC even when the VM name stays the same.

After a destroy/recreate:

read the new MAC from Proxmox or the guest agent;
replace the stale reservation on the owning DHCP server;
verify the old lease cannot be assigned unexpectedly;
renew the lease and confirm the intended address; and
update the vault and DNS if either value changed.

Bootstrap Lease Pointers

Temporary VM leases may be recorded in their operating runbook and in .env.local only where that file is the documented tier-0 pointer. Do not create per-project environment files.

Reconciliation Gate

An assignment passes when the endpoint reports the intended IP/CIDR and gateway state, the DHCP server shows the intended owner, no second DHCP server answers, forward and PTR records match the current DNS phase, the vault agrees with runtime state, and a reboot or lease renewal returns the same result.

Use the Network Validation Runbook to capture that evidence.