@jwildeboer
I'm not sure im reading that right, but since I just spent a bit of time redoing DNS at home: having two DNS servers and DHCP in the mix I found out that hostnames do not resolve if I ask "the wrong one". Might just be the same thing or not at all, worth the toot.

So in the end I completely gave up on using hostnames, and instead im doing split horizon DNS and assigning one A/AAAA record e.g. <name>.host.my.tld for every metal or virtual machine. A bit more annoying to type but hey. Once I got my zones and authorative servers right all my problems went away.

@homelab

@jwildeboer
Can you mount the host certs and shadow whatever is in the containers? Should work and reduce CA distribution to the hosts only.
I am just (very slowly) rolling out Lego(CLI) + a push job to move LE certs around. Once this is done I'll be dealing with vault and the same problem.

CA is kind of easy to fix on the incus system containers via terraform. Container apps I manage through lazy ansible and my plan was to do it by mounting the lab CA. On k8s we just roll out configmaps and mount them in the pods. Slightly tempted to redeploy kubernetes at home just for things like that ..
@homelab