Skip to content

Network: fmm.house, split-horizon DNS, no port forwarding

  1. traefik (Docker, ports 80/443): wildcard *.fmm.house Let's Encrypt via porkbun DNS-01. File-provider routes to host-net services (172.30.0.1:PORT).
  2. AdGuard Home as LAN DNS: rewrites *.fmm.house → LAN IP (A-only — AAAA rewrites deliberately absent so prefix rotation can't strand clients), upstream Quad9 DoH/DoT. Router hands out AdGuard; Google Wifi acts as a DNS proxy for both families.
  3. WAN without port-forwarding: public zone contains exactly one record — ha.fmm.house AAAA → the tailscale IPv6. On the tailnet it works anywhere; off it, nothing is exposed.
  4. ufw discipline: docker-published ports do NOT bypass ufw here; every traefik→service hop needs an explicit allow from 172.30.0.0/24 to any port N.
  5. Domain roster ended as: ha, z2m, ma, eh (ESPHome), ag (AdGuard), tr (TRMNL).
  6. Vanity IPv6: token GUA ::49 + ULA fd00:6176::49 ("av" in hex). Mesh routers filter custom RAs — radvd was a dead end; the token approach survived.