rdmsm4x-changelog-20260914-1533-starlink18a-dns-and-dns-cleanup

Added starlink18a.dataroo.net → tailnet endpoint 18a-rdpi5b, and cleaned stale/dead DNS in Cloudflare (55→39), UDM local DNS (17→13 host-records) and fleet /etc/hosts. Every change was backed up and can be undone.

When: 2026-09-14 15:17 – 15:33 EDT
Scope: Cloudflare zone dataroo.net; UDM 192.168.1.1; /etc/hosts on rdmsm4x, rdmbair13m5, rdmbair15m5, rdmpw3265m, rdmpw3275m (jdmbair13m5 inspected, unchanged)
Full detail: rdmsm4x:~/dev/net/fleet-netmgmt/docs/findings.md § 2026-09-14 (commit 4aaaf0f)

Changes

Cloudflare: + starlink18a A 100.103.136.116 / AAAA fd7a:115c:a1e0::6138:8876 (DNS-only, TTL 300).
Cloudflare: − 16 CNAMEs to dataroo-homelab-tunnel with no ingress (all HTTP 404): ai air13 air15 api auth db1 docs litellm llm log m4x pw3265 pw3275 up uptime www; − 18a A .214 (523), − eero18b.18b A .211 (closed).
UDM: disabled local DNS on rdmbairM3.local, rdmbpM4a-2.local, rdmpw3265m-wifi.local (all stale) and rdmbair13m5.dataroo.net (roaming laptop; DDNS now authoritative). Restarted unifi.
/etc/hosts: removed TEMPORARY ts.dataroo.net fallback block on 5 hosts; removed dead 192.168.1.8 unaspro18a on rdmpw3265m.

Verification

DoH and the UDM resolver answer starlink18a correctly. ssh [email protected] reached rdpi5b. Zone diff showed exactly 18 records removed and 2 added. dnsmasq re-rendered at 15:26:41. *.ts names still resolve on 4 hosts, and unaspro18a resolves to 192.168.0.7 on rdmpw3265m.

Backups / undo

Cloudflare: ~/dev/net/cloudflare/backups/dataroo.net-dns-records-20260914-1520-pre-cleanup.json (POST any record back)
UDM: /data/backup-claude/user-stale-dns-20260914-152609.jsonl; set local_dns_record_enabled:true again, then restart unifi
hosts: /etc/hosts.bak-claude-20260914 (and …b on rdmpw3265m); sudo cp back

Owner actions (Rich)

Security: apex dataroo.net publicly serves the UniFi OS login page (no Access app). Decide: add an Access app, or drop the apex A records. 75.127.200.210:443 is also open directly.
prometheus.dataroo.net returns 404 and :9090 is closed on rdmpw3265m. Remove it, or restore its ingress.
Tailscale admin: have 18a-rdpi5b advertise 10.0.4.0/22 if off-site access to Starlink-side devices is wanted, and clear the stale 10.0.4.0/24 route on 701-apple-tv-bedroom.