daystrom-docs/infrastructure/dns.md

# DNS

**Last updated:** 2026-08-11

## Domain Overview

The institute uses two primary domains for hosted services. Both are publicly
accessible — there is no split-horizon or network-zone separation between them.
The distinction is **audience-based**, determined per-service by the operator.

| Domain | Audience |
|--------|----------|
| `pldyn.net` | Operator and technical audience — dashboards, dev tools, infrastructure services |
| `sundialer.net` | Family-facing consumer services |

Domain assignment is not automatic. When deploying a new service, use judgement
based on the audience above. If the assignment is not obvious, ask the operator.

## Service Assignment Reference

Observable pattern from live Traefik configuration:

| Domain | Services |
|--------|----------|
| `sundialer.net` | audiolib/podcasts, boxoffice, dawarich, navidrome/music, oCIS, paperless-ngx |
| `pldyn.net` | beszel, bin, cdn, drawpile, gitea/vcs, immich/curator, lcarsdb, solidtime, traefik, vaultwarden, yaade, actual, omni-tools, daystrom-relay, pldyn.net (main site) |

### External Services (own domains — not subject to the split above)

- `sarimportauthority.org`
- `convectionand.coffee`
- `bluejeanblankie.com`
- `raccoonsoncaffeine.cool`

## Wildcard Patterns

| Domain | Pattern |
|--------|---------|
| `pldyn.net` | `*.pldyn.net` |
| `sundialer.net` | `*.sundialer.net` |

## Certificate Issuance

- **Provider:** Cloudflare (DNS challenge)
- **Managed by:** Traefik — cert issuance and renewal are automatic
- **Challenge method:** DNS-01 (no HTTP challenge port required)

Traefik uses Cloudflare API credentials (stored as Swarm secrets / env vars,
not in documentation) to complete the DNS challenge and obtain Let's Encrypt
certificates for both domains.