Skip to content

ADR-0002: DNS and ingress use dedicated LXCs

  • Status: Accepted
  • Date: 2026-06-22

Context and decision

DNS and public ingress are recovery-critical, bind low ports, and hold different sensitive state from applications. Technitium runs in CT 102 and Caddy ingress runs in CT 103, both separate from CT 101.

Alternatives

Running both in CT 101, combining them in one infrastructure guest, or lowering rootless privileged-port restrictions were rejected.

Consequences

Failure domains and startup order are clearer, but Proxmox, OPNsense, and cross-LXC routing remain shared dependencies. Each LXC requires its own backup.

Validation evidence

DNS on 192.168.2.2:53 and Caddy v2.11.4 on :80/:443 were active on 2026-07-17.