2026-08-04 15:00:33 +02:00
|
|
|
---
|
|
|
|
|
okf: "0.1"
|
|
|
|
|
type: phase
|
|
|
|
|
visibility: private
|
|
|
|
|
status: active
|
|
|
|
|
updated: 2026-07-07
|
|
|
|
|
links: []
|
|
|
|
|
---
|
|
|
|
|
|
2026-07-07 20:46:57 +02:00
|
|
|
# Migracja okit.pl: 42.pl (FreeDNS) -> Cloudflare — plan faz
|
|
|
|
|
|
|
|
|
|
Cel: okit.pl na Cloudflare (jak kapala.org) -> wildcard *.okit.pl DNS-01 ->
|
|
|
|
|
koniec z martwymi certami (HTTP-challenge na 42.pl nie przechodzil, cert wygasl 28.06).
|
|
|
|
|
Rejestrator: ViPower.pl. DNS byl: 42.pl FreeDNS. Poczta: Fastmail (messagingengine).
|
|
|
|
|
|
|
|
|
|
## Status
|
|
|
|
|
- FAZA 0 (przeniesienie strefy 1:1) — WYKONANA i ZWERYFIKOWANA 2026-07-07.
|
|
|
|
|
- 31 rekordow odtworzonych 1:1 w Cloudflare (zweryfikowane vs AXFR), wszystko DNS-only.
|
|
|
|
|
- Poczta zachowana: MX x2, SPF TXT, DKIM CNAME x3 (DNS-only, DKIM nie proxowany).
|
|
|
|
|
- DNSSEC OFF. NS w ViPower: fns1/fns2.42.pl -> dom.ns + katja.ns.cloudflare.com.
|
|
|
|
|
- Propagacja OK: dig NS okit.pl = cloudflare. Autorytatywnie forgejo=135.181.153.108,
|
|
|
|
|
immich=87.205.110.38, MX=messagingengine, DKIM=fmhosted — 1:1 z AXFR.
|
|
|
|
|
- FAZA 1 (wildcard cert *.okit.pl DNS-01 w npm@PIHA) — TODO (nastepny krok).
|
|
|
|
|
- FAZA 2 (reorganizacja mesh/public) — TODO.
|
|
|
|
|
|
|
|
|
|
## WAZNE: split-horizon DNS (Pi-hole)
|
|
|
|
|
Pi-hole na PIHA (192.168.31.5:8888) ma Local DNS Records nadpisujace czesc okit.pl
|
|
|
|
|
na 192.168.31.5 (LAN) — ruch w LAN prosto do PIHA (omija hairpin NAT). Skutek: dig
|
|
|
|
|
z hosta na Pi-hole pokazuje 192.168.31.5, nie IP z Cloudflare. To NIE blad. Przy
|
|
|
|
|
Fazie 2 pamietac o OBU warstwach: Cloudflare (swiat+cert) I Pi-hole Local DNS (LAN).
|
|
|
|
|
|
|
|
|
|
## NS Cloudflare: dom.ns.cloudflare.com + katja.ns.cloudflare.com
|
|
|
|
|
|
|
|
|
|
## FAZA 1 — wildcard *.okit.pl
|
|
|
|
|
npm@PIHA: cert *.okit.pl przez Cloudflare DNS-01 (jak *.kapala.org, npm-49). Token
|
|
|
|
|
Cloudflare Zone:DNS:Edit dla okit.pl. Potem stare per-host certy okit.pl wygasic.
|
|
|
|
|
|
|
|
|
|
## FAZA 2 — mesh vs public (kapala=mesh, okit=public):
|
|
|
|
|
- owntracks-frontend -> MESH (decyzja 2026-07-06; teraz 87.205)
|
|
|
|
|
- immich, foty -> public
|
|
|
|
|
- reszta (grafana, vikunja, ha, home, vault, wiki) -> wiekszosc kandydaci mesh
|
|
|
|
|
- martwe (router/printer/tasmota/node-red/slzb/ap/code-server/audiobooks) -> audyt+usun
|
|
|
|
|
- PAMIETAC: zmiana w Cloudflare + ewentualnie Pi-hole Local DNS.
|
|
|
|
|
|
|
|
|
|
## AXFR okit.pl (stan PRZED, 2026-07-06, fns2.42.pl)
|
|
|
|
|
okit.pl A 135.181.153.108
|
|
|
|
|
MX 10 in1-smtp.messagingengine.com / MX 20 in2-smtp.messagingengine.com
|
|
|
|
|
TXT v=spf1 include:spf.messagingengine.com ?all
|
|
|
|
|
fm1/fm2/fm3._domainkey CNAME fmN.okit.pl.dkim.fmhosted.com
|
|
|
|
|
-> 135.181.153.108: agents chha chz2m forgejo gethumanai hai joplin outline vps vps-npm www
|
|
|
|
|
-> 87.205.110.38: foty grafana ha-ken home immich owntracks owntracks-frontend vikunja
|
|
|
|
|
-> 100.108.208.3: ha
|
