DNS VMs (Technitium)
Architecture reference for the four Technitium DNS VMs: placement, addresses, zone replication, RFC 2136 updates, and firewall rules.
Four Technitium DNS Server v14+ VMs serve the core.aorxi.io internal zone across both sites. Their placement, authority, replication, dynamic updates, and firewall boundaries are defined here. Installation and client migration follow the DNS deployment and cutover runbook.
VM Inventory
All four VMs sit on VLAN 30 (VM Services) and are sized identically: 2 vCPU, 1 GB RAM, 8 GB disk. Technitium runs as a Proxmox LXC container (Ubuntu 22.04) or VM. DNS listens on port 53; the web UI and cluster API listen on port 5380.
| VM | Site | Proxmox Host | IP | Role |
|---|---|---|---|---|
sa-dns-01 | Site A | sa-stor-01 | 10.10.30.10 | Primary |
sa-dns-02 | Site A | see caution below | 10.10.30.11 | Secondary |
sb-dns-01 | Site B | sb-cmp-01 | 10.20.30.10 | Secondary |
sb-dns-02 | Site B | sb-cmp-02 | 10.20.30.11 | Secondary |
Tentative: sa-dns-02 Host Not Confirmed
The Proxmox host for sa-dns-02 is sa-cmp-01 or sa-cmp-02. The choice has not been finalized.
Replication and Cluster
sa-dns-01 is the authoritative primary. All zones are authored there; the other three nodes are read-only secondaries. sa-dns-01 sends DNS NOTIFY to all secondaries on every zone change. Zone transfers are secured with the TSIG key opnsense-ddns (HMAC-SHA256). Default zone TTL is 300 s.
| Replication path | Transport | Port | Auth |
|---|---|---|---|
sa-dns-01 → sa-dns-02 | AXFR (TCP) | 53 | TSIG opnsense-ddns |
sa-dns-01 → sb-dns-01 | AXFR (TCP) over WireGuard | 53 | TSIG opnsense-ddns |
sa-dns-01 → sb-dns-02 | AXFR (TCP) over WireGuard | 53 | TSIG opnsense-ddns |
Zone transfer is restricted to specific IPs only: 10.10.30.11, 10.20.30.10, 10.20.30.11.
WireGuard Dependency for Site B
sb-dns-01 and sb-dns-02 pull zone updates over the WireGuard tunnel. If the tunnel is down, Site B nodes serve their last replicated copy: stale but functional for resolution. New or changed records do not appear at Site B until the tunnel recovers.
Technitium Cluster
The Technitium cluster synchronizes server settings, apps, and catalog zone membership from sa-dns-01 to all secondaries. This process is separate from AXFR zone replication. All four nodes are managed from the sa-dns-01 web panel at http://10.10.30.10:5380.
Zone Design
Forward Zone
One primary forward zone: core.aorxi.io. Hosted as Primary on sa-dns-01, replicated as Secondary to the other three nodes. SOA primary NS: sa-dns-01.core.aorxi.io. NS records are added for all four VMs.
Recursion is enabled with full root-server resolution: no upstream forwarders configured.
Reverse Zones
All reverse zones are created as Primary on sa-dns-01 and replicated identically. The zone name is formed by reversing the network octets and appending .in-addr.arpa. Each /24 VLAN gets one zone; /22 VLANs (40 and 100) each produce four /24 zones.
Site A reverse zones (representative set):
| VLAN | Subnet | Reverse zone |
|---|---|---|
| 10 | 10.10.10.0/24 | 10.10.10.in-addr.arpa |
| 20 | 10.10.20.0/24 | 20.10.10.in-addr.arpa |
| 25 | 10.10.25.0/24 | 25.10.10.in-addr.arpa |
| 30 | 10.10.30.0/24 | 30.10.10.in-addr.arpa |
| 40 | 10.10.40.0/22 | 40.10.10.in-addr.arpa, 41.10.10.in-addr.arpa, 42.10.10.in-addr.arpa, 43.10.10.in-addr.arpa |
| 60 | 10.10.60.0/24 | 60.10.10.in-addr.arpa |
| 90 | 10.10.90.0/24 | 90.10.10.in-addr.arpa |
| 100 | 10.10.100.0/22 | 100.10.10.in-addr.arpa, 101.10.10.in-addr.arpa, 102.10.10.in-addr.arpa, 103.10.10.in-addr.arpa |
Site B follows the same pattern with 10.20.x → x.20.10.in-addr.arpa. The WireGuard transit subnet (10.255.0.0/24) gets a single zone: 0.255.10.in-addr.arpa.
DHCP DNS Assignment
At Site A cutover, OPNsense serves client VLANs 100/110/120 and initially advertises its local VLAN interface as DNS. After Technitium is authoritative, it advertises the Site A pair below. Site B DHCP remains on OPNsense.
| Site | DNS Server 1 | DNS Server 2 |
|---|---|---|
| Site A | 10.10.30.10 (sa-dns-01) | 10.10.30.11 (sa-dns-02) |
| Site B | 10.20.30.10 (sb-dns-01) | 10.20.30.11 (sb-dns-02) |
RFC 2136 Dynamic Updates
Dynamic DNS registration is enabled for three VLANs. All other VLANs (10, 20, 25, 60, 65, 80, 90, 253) use static records managed manually in the Technitium UI on sa-dns-01.
| VLAN | Direction | Notes |
|---|---|---|
| 30 (VM Services) | A + PTR | New VMs auto-register |
| 40 (Kubernetes Nodes) | A + PTR | Kubernetes node VMs |
| 100 (Lab / Trusted Client) | A + PTR | Dev and admin devices |
All dynamic updates are signed with the opnsense-ddns TSIG key. The Site A
client-VLAN DDNS path remains on OPNsense and must be validated during A8.
OPNsense DDNS
OPNsense-managed scopes send RFC 2136 updates to sa-dns-01. This is the path
for Site A client VLANs 100/110/120 as well as the Site B scopes.
Update Server: 10.10.30.10 # sa-dns-01 — both sites point here
Protocol: RFC 2136
Zone: core.aorxi.io (forward) / <reverse-zone> (PTR)
Key name: opnsense-ddns
Key algorithm: hmac-sha256
Key secret: <generated on sa-dns-01>
TTL: 300Site B DHCP DDNS updates travel over WireGuard to reach sa-dns-01. New DHCP leases on Site B do not auto-register until the tunnel is up: acceptable for an infra-change workflow.
Kubernetes External-DNS
external-dns pushes Kubernetes Ingress and Service hostnames into Technitium via RFC 2136. The same opnsense-ddns TSIG key is reused. Deployment args:
- --source=ingress
- --source=service
- --provider=rfc2136
- --rfc2136-host=10.10.30.10 # sa-dns-01 primary
- --rfc2136-port=53
- --rfc2136-zone=core.aorxi.io
- --rfc2136-tsig-secret=<opnsense-ddns-secret>
- --rfc2136-tsig-secret-alg=hmac-sha256
- --rfc2136-tsig-keyname=opnsense-ddns
- --rfc2136-tsig-axfr=true
- --domain-filter=core.aorxi.io
- --txt-owner-id=k8s-site-a # use k8s-site-b for Site B cluster
- --policy=upsert-onlyThe txt-owner-id prevents the two site clusters from clobbering each other's TXT ownership records.
Firewall Rules
Rules are applied on OPNsense at each site on the WireGuard interface.
Site A: WireGuard Inbound
| Proto | Source | Dest | Port | Purpose |
|---|---|---|---|---|
| TCP | 10.20.30.10, 10.20.30.11 | 10.10.30.10 | 53 | AXFR pull (sb-dns-01/02) |
| UDP | 10.20.30.10, 10.20.30.11 | 10.10.30.10 | 53 | DDNS updates (OPNsense-B) |
| TCP | 10.255.0.2 | 10.10.30.10 | 5380 | Technitium cluster API |
Site B: WireGuard Inbound
| Proto | Source | Dest | Port | Purpose |
|---|---|---|---|---|
| UDP | 10.10.30.10 | 10.20.30.10, 10.20.30.11 | 53 | NOTIFY from sa-dns-01 |
| TCP | 10.10.30.10 | 10.20.30.10, 10.20.30.11 | 5380 | Technitium cluster API |
| UDP | any Site B client VLAN | 10.20.30.10, 10.20.30.11 | 53 | Client queries |
| TCP | any Site B client VLAN | 10.20.30.10, 10.20.30.11 | 53 | Client queries (large responses) |
Related Pages
- DNS Deployment & Cutover Runbook: installation, clustering, zone creation, TSIG, validation, and client migration
- DNS: DNS architecture, zone design rationale, and infrastructure record tables
- WireGuard: site-to-site VPN that carries cross-site AXFR and DDNS traffic
- VLAN Reference: VLAN 30 (VM Services) where all DNS VMs reside
- Kubernetes Planning:
external-dnsand Kubernetes service DNS integration - CA & Certificates: Let's Encrypt DNS-01 certificate strategy via Cloudflare
Platform Services
Application and platform services for the AORXI homelab: internal DNS via Technitium VMs, OpenBao secrets management, the UniFi OS Server controller, Kafka and database operations patterns, container build infrastructure, and certificate management via Let's Encrypt DNS-01 and step-ca.
DNS Deployment & Cutover Runbook
Install and cluster the four Technitium DNS instances, create replicated zones, enable signed updates, and migrate clients from OPNsense Unbound.