Unbound

A mis-typed IP address quietly turned one branch of the lab’s encrypted DNS into plaintext, and the only reason I found it was that I started shipping resolver logs the same day.

Retiring an abandoned container image across two fleets, teaching nginx to stop caching a container’s IP, and a research digest that mostly reported things fixing themselves.

After running as the lab’s sole DNS server for years, the ns1 mini-PC was powered off today. Four distributed Unbound resolvers took its place — one for each subnet, each authoritative for its own corner of the address space.