Two fixes from the step 5 re-audit:
1. The joplin/public-tool evidence blocks showed bracketed placeholders
inside function arguments ('joplin.[app-to-app zone]') - not valid
syntax, wouldn't produce the shown NXDOMAIN for the claimed reason.
Replaced with result tables showing the same real data honestly.
2. Added the real Technitium screenshot of the cleaned-up reverse zone.
Getting this screenshot caught a real methodology error: an earlier
claim of '2 real PTR records (automation, caddy)' was wrong - the
automation entry only resolved because I tested it by SSHing into
automation itself, which satisfied the lookup via its own local
/etc/hosts, never actually querying Technitium. Querying from a
different host returns NXDOMAIN, matching the screenshot's real
3-record zone (NS, SOA, one PTR) exactly. Only 1 real PTR record
exists. Same error existed in the KB, fixed there too.
The rest of the doc consistently says 'browser-facing zone'/'app-to-app
zone' and never states the literal domain suffixes. One evidence code
block leaked both real domains as part of the FQDNs being resolved -
fixed to match the doc's own established pattern. Caught because I'd
only sanitize-checked my own diff, not the whole file - full-file grep
for thesabear.net now confirms zero literal domain mentions.
Live audit found 4 records in the reverse zone, all wrong: 2 malformed
PTR entries (name/value swapped, never actually resolved), 1 orphaned
record from a decommissioned host, 1 correct-looking but misleading
record (proxy host's PTR pointing at one proxied app's name instead of
its own identity). All fixed live on Technitium today, not just
documented. Doc updated to describe the real defect and the fix.
Live-verified against the real Technitium server: spot-checked
caddy-only/local-only hosts and Postiz's zero-presence claim via
direct DNS resolution, confirmed the forwarder list directly from the
real dns.config (pfSense + Quad9 only, no Cloudflare), and confirmed
the reverse zone's real /24 scope plus its sparse PTR content via
live reverse lookups - fixed the KB stamp accordingly after an
earlier version of it claimed these weren't re-checked. Replaced the
mermaid zone-routing diagram with a real branch-shaped Nextcloud
diagram. Real command output embedded throughout instead of
paraphrased claims.
Removed by request - it was the one unfinished system in the repo,
and it's the user's call on what represents them publicly. Removed
completely: the README section, docs/content-pipeline.md, and the
two stacks that only existed to back it (postiz, nocodb-content).
Fixed cross-links in dns-naming.md and firewall-and-network.md that
pointed at it (replaced the public-facing-app example with the
still-present Ghost blog), and notifications.md (dropped the
reference, also fixed a leftover 'documented rather than hidden'
phrase in the same paragraph). Stat strip and stack counts updated
(55->53 stacks, 16->15 systems).
Names real technology throughout (Vault, Authentik, pfSense,
firewalld, Wazuh) instead of staying generic, adds a 'why this
approach vs the alternative' section to every doc, cross-links
heavily between docs instead of treating each system in isolation.
Names real technology (Technitium) instead of staying vague, adds
explicit cross-links to every other system that actually depends on
DNS, explains why self-hosted DNS was chosen, and adds a 'what I'd
improve' section. Template for redoing the rest.
Mermaid diagrams up front, GFM alert callouts for key decisions and
gotchas, tables instead of bullet walls - replaces plain prose with
the visual template established for security-monitoring.md.
Secrets & PKI, Secret Distribution Model, SSO & Identity,
Firewall & Network Segmentation, DNS Naming Model, and Security
Monitoring - the first batch of per-system write-ups linked from
the new README, sourced and sanitized from the internal KB.
automation-bot
thesabear