From dd1e7acaf7ac8c15e381b579aec74f13dd159d1c Mon Sep 17 00:00:00 2001
From: DaystromMoira <skyerangerdelta+1@pldyn.net>
Date: Tue, 11 Aug 2026 11:50:48 +0000
Subject: [PATCH] docs(infra): add DNS split-horizon topology

---
 infrastructure/dns.md | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 infrastructure/dns.md

diff --git a/infrastructure/dns.md b/infrastructure/dns.md
new file mode 100644
index 0000000..7a63145
--- /dev/null
+++ b/infrastructure/dns.md
@@ -0,0 +1,38 @@
+# DNS
+
+**Last updated:** 2026-08-11
+
+## Split-Horizon DNS
+
+The institute runs split-horizon DNS: internal and external services share
+different domain namespaces to prevent internal service URLs from leaking
+publicly.
+
+| Scope | Domain | Usage |
+|-------|--------|-------|
+| Internal | `pldyn.net` | Services accessible only inside the management subnet |
+| External | `sundialer.net` | Services exposed to the public internet |
+
+## Wildcard Patterns
+
+| Scope | Pattern |
+|-------|---------|
+| Internal | `*.pldyn.net` |
+| External | `*.sundialer.net` |
+
+## Certificate Issuance
+
+- **Provider:** Cloudflare (DNS challenge)
+- **Managed by:** Traefik — cert issuance and renewal are automatic
+- **Challenge method:** DNS-01 (no HTTP challenge port required)
+
+Traefik uses Cloudflare API credentials (stored as Swarm secrets / env vars,
+not in documentation) to complete the DNS challenge and obtain Let's Encrypt
+certificates for both domains.
+
+## Notes
+
+- DNS records for `*.pldyn.net` resolve to internal IPs; they are not
+  publicly routable.
+- DNS records for `*.sundialer.net` resolve to the public-facing IP managed
+  by Unifi / Cloudflare.