7:[["$","h1",null,{"id":"federated-lan-network-with-distributed-dns-and-pki","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#federated-lan-network-with-distributed-dns-and-pki","children":["$","span",null,{"className":"icon icon-link"}]}],"Federated LAN Network with Distributed DNS and PKI"]}],"\n",["$","h2",null,{"id":"tldr","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#tldr","children":["$","span",null,{"className":"icon icon-link"}]}],"TL;DR"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":["Each LAN owns a unique ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}]," from ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"100.64.0.0/10"}],", with standard roles: ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".1"}]," router, ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".2"}]," VPN, ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".253"}]," CA, ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".254"}]," DNS."]}],"\n",["$","li",null,{"children":["Internal TLDs (e.g., ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".tpl"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".games"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".media"}],") are delegated to LANs. Zones follow ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"lan.tld"}]," and resolvers forward over VPN using published NS records."]}],"\n",["$","li",null,{"children":["An offline root CA signs LAN-specific intermediates with strict Name Constraints. Each LAN runs ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"step-ca"}]," (ACME + mTLS) for automated issuance."]}],"\n",["$","li",null,{"children":["WireGuard mesh advertises LAN ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}],"s via AllowedIPs. DNS traverses the VPN; DNS-over-TLS between resolvers is optional."]}],"\n",["$","li",null,{"children":"Everything is governed via GitOps: signed PRs, ≥2 approvals, and CI validations for allocations, delegations, and PKI policy."}],"\n",["$","li",null,{"children":"Jump to SOPs to onboard a LAN, add a TLD, enroll hosts, or handle incidents."}],"\n"]}],"\n",["$","h2",null,{"id":"architecture-overview","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#architecture-overview","children":["$","span",null,{"className":"icon icon-link"}]}],"Architecture Overview"]}],"\n",["$","p",null,{"children":["PWAN is a federated, backbone-free design. Every LAN is a first-class citizen that is both authoritative for its zones and a recursive resolver for others. Trust is anchored in an offline root CA; day-to-day issuance happens locally using per-LAN intermediates constrained to their zones and subnet. Connectivity is a simple WireGuard mesh advertising each LAN’s ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}],". Governance, allocations, and delegations live in a shared Git repository enforced by CI."]}],"\n",["$","p",null,{"children":"What this yields:"}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Clear ownership boundaries per LAN with predictable addressing and naming"}],"\n",["$","li",null,{"children":"Low operational coupling (no central DNS/PKI choke point)"}],"\n",["$","li",null,{"children":"Cryptographic trust that scales across LANs without sharing private keys"}],"\n",["$","li",null,{"children":"Auditable, reversible changes through Git"}],"\n"]}],"\n",["$","h2",null,{"id":"how-to-use-this-guide","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#how-to-use-this-guide","children":["$","span",null,{"className":"icon icon-link"}]}],"How to Use This Guide"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Read the PWAN Standard for the normative baseline (addressing, DNS, PKI, VPN, GitOps, security, SLOs)."}],"\n",["$","li",null,{"children":"Use the SOPs for step-by-step operations: onboarding, new TLDs, host enrollment, incident response, and change management."}],"\n",["$","li",null,{"children":"Run the Validation suite before and after changes; see the Example Artifacts and Templates to bootstrap your repo and CA."}],"\n"]}],"\n",["$","h2",null,{"id":"background--setup-guide","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#background--setup-guide","children":["$","span",null,{"className":"icon icon-link"}]}],"Background & Setup Guide"]}],"\n",["$","p",null,{"children":"This section is a practical, example-driven overview of how PWAN works before we dive into the strict standard and SOPs."}],"\n",["$","h3",null,{"id":"example-lans-and-tlds","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#example-lans-and-tlds","children":["$","span",null,{"className":"icon icon-link"}]}],"Example LANs and TLDs"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"opti"}]," → 100.64.1.0/24, DNS at 100.64.1.254"]}],"\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"whatscs"}]," → 100.64.2.0/24, DNS at 100.64.2.254"]}],"\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"tritton"}]," → 100.64.3.0/24, DNS at 100.64.3.254"]}],"\n"]}],"\n",["$","p",null,{"children":["Common internal TLDs: ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".tpl"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".games"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".media"}],". Each LAN typically manages zones like ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"opti.tpl"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"opti.games"}],"."]}],"\n",["$","h3",null,{"id":"dns-setup-authoritative-zones-per-lan","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#dns-setup-authoritative-zones-per-lan","children":["$","span",null,{"className":"icon icon-link"}]}],"DNS Setup: Authoritative Zones per LAN"]}],"\n",["$","p",null,{"children":["Example ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"opti.tpl"}],":"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-dns","children":"$$ORIGIN opti.tpl.\n@ IN SOA ns1.opti.tpl. admin.opti.tpl. (1 12h 15m 2w 2h)\n IN NS ns1.opti.tpl.\nrouter IN A 100.64.1.1\nvpn IN A 100.64.1.2\nweb IN A 100.64.1.100\nns1 IN A 100.64.1.254\n"}]}],"\n",["$","p",null,{"children":["Example ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"opti.games"}],":"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-dns","children":"$$ORIGIN opti.games.\n@ IN SOA ns1.opti.games. admin.opti.games. (1 12h 15m 2w 2h)\n IN NS ns1.opti.games.\ngame1 IN A 100.64.1.10\ngame2 IN A 100.64.1.11\nns1 IN A 100.64.1.254\n"}]}],"\n",["$","h3",null,{"id":"delegation-across-lans","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#delegation-across-lans","children":["$","span",null,{"className":"icon icon-link"}]}],"Delegation Across LANs"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"LANs publish authoritative NS records for the zones they own; peers forward to these."}],"\n",["$","li",null,{"children":"Root TLD ownership and delegations are governed via GitOps with multi-approval."}],"\n",["$","li",null,{"children":"Subdomains are managed locally per LAN; co-admin of a TLD is allowed via approved PRs."}],"\n"]}],"\n",["$","p",null,{"children":["Example delegation for ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"opti.tpl"}]," on other LANs:"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-dns","children":"opti.tpl. IN NS ns1.opti.tpl.\n"}]}],"\n",["$","h3",null,{"id":"resolution-flow-at-a-glance","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#resolution-flow-at-a-glance","children":["$","span",null,{"className":"icon icon-link"}]}],"Resolution Flow (at a glance)"]}],"\n",["$","p",null,{"children":["Clients query the local ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".254"}]," resolver. It answers for local zones; otherwise it forwards over the VPN to the authoritative LAN and caches the result."]}],"\n",["$","h3",null,{"id":"federated-pki-quickstart","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#federated-pki-quickstart","children":["$","span",null,{"className":"icon icon-link"}]}],"Federated PKI Quickstart"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Offline root CA signs LAN-specific intermediates."}],"\n",["$","li",null,{"children":"Clients trust only the root; LAN-issued certs are valid network-wide."}],"\n",["$","li",null,{"children":"For commands and profiles, see PKI Standard and SOP C."}],"\n"]}],"\n",["$","h3",null,{"id":"routing--connectivity","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#routing--connectivity","children":["$","span",null,{"className":"icon icon-link"}]}],"Routing & Connectivity"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":["Each LAN manages its ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}]," from the shared CGNAT space."]}],"\n",["$","li",null,{"children":["WireGuard/ZeroTier mesh connects LAN nodes; AllowedIPs advertise peer ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}],"s."]}],"\n",["$","li",null,{"children":"Non-local DNS queries traverse the VPN to peer authoritative NS."}],"\n",["$","li",null,{"children":"Start with static routes; add BGP/FRR for scale."}],"\n",["$","li",null,{"children":"Use VLANs internally per LAN to isolate traffic."}],"\n"]}],"\n",["$","h3",null,{"id":"optional-l2l25-tunneling","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#optional-l2l25-tunneling","children":["$","span",null,{"className":"icon icon-link"}]}],"Optional L2/L2.5 Tunneling"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"GRE/EoIP/VXLAN/MPLS/L2TP as needed for bridging or advanced routing/QoS."}],"\n",["$","li",null,{"children":"Pros: preserves Ethernet frames, eases VLAN/VXLAN migration, rich traffic engineering."}],"\n",["$","li",null,{"children":"Cons: added overhead, MTU tuning, and configuration complexity."}],"\n"]}],"\n",["$","h3",null,{"id":"adding-new-tlds","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#adding-new-tlds","children":["$","span",null,{"className":"icon icon-link"}]}],"Adding New TLDs"]}],"\n",["$","p",null,{"children":"See SOP B for the authoritative workflow. In brief: propose via PR, get approvals, resolvers sync, then authoritative LANs publish zones."}],"\n",["$","h3",null,{"id":"security-automation--gitops-high-level","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#security-automation--gitops-high-level","children":["$","span",null,{"className":"icon icon-link"}]}],"Security, Automation & GitOps (high-level)"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Central Git repo tracks TLD ownership, delegations, IP allocations, and policies."}],"\n",["$","li",null,{"children":"LAN DNS servers sync periodically to learn which TLDs exist and the authoritative LANs."}],"\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"step-agent"}]," automates certificate lifecycle."]}],"\n",["$","li",null,{"children":"CI enforces policy; PRs are signed and require multiple approvals."}],"\n"]}],"\n",["$","h3",null,{"id":"benefits-recap","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#benefits-recap","children":["$","span",null,{"className":"icon icon-link"}]}],"Benefits Recap"]}],"\n",["$","h2",null,{"id":"pwan-standard-v01-draft","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#pwan-standard-v01-draft","children":["$","span",null,{"className":"icon icon-link"}]}],"PWAN Standard (v0.1-draft)"]}],"\n",["$","p",null,{"children":"This section defines a normative baseline for all participating LANs. RFC-2119 language is used: MUST, SHOULD, MAY."}],"\n",["$","h3",null,{"id":"1-scope--principles","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#1-scope--principles","children":["$","span",null,{"className":"icon icon-link"}]}],"1) Scope & Principles"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":["Each LAN is autonomous for its own ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}],", DNS zones, and subordinate CA."]}],"\n",["$","li",null,{"children":"Interoperability depends on consistent addressing, naming, PKI profiles, and GitOps governance."}],"\n",["$","li",null,{"children":"Security by default: least privilege, mTLS, immutable infra via Git, auditable changes."}],"\n"]}],"\n",["$","h3",null,{"id":"2-addressing--node-roles","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#2-addressing--node-roles","children":["$","span",null,{"className":"icon icon-link"}]}],"2) Addressing & Node Roles"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":["Address space: CGNAT ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"100.64.0.0/10"}],"."]}],"\n",["$","li",null,{"children":["Allocation unit: each LAN MUST receive a unique ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}],"."]}],"\n",["$","li",null,{"children":["Reserved host addresses per LAN subnet:","\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".1"}]," router/gateway (MUST)"]}],"\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".2"}]," VPN endpoint (MUST)"]}],"\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".10–.99"}]," general infra (MAY)"]}],"\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".100–.199"}]," servers/services (SHOULD)"]}],"\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".200–.239"}]," clients (MAY)"]}],"\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".253"}]," CA/PKI endpoint (SHOULD)"]}],"\n",["$","li",null,{"children":[["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".254"}]," DNS resolver/authoritative (MUST)"]}],"\n"]}],"\n"]}],"\n"]}],"\n",["$","p",null,{"children":["Example: ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"opti"}]," → ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"100.64.1.0/24"}],", DNS ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"100.64.1.254"}],"."]}],"\n",["$","h3",null,{"id":"3-naming--dns-conventions","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#3-naming--dns-conventions","children":["$","span",null,{"className":"icon icon-link"}]}],"3) Naming & DNS Conventions"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":["Allowed internal TLDs are managed via GitOps (see Governance). Examples: ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".tpl"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".games"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".media"}],"."]}],"\n",["$","li",null,{"children":["Zones SHOULD follow ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"lan.tld"}]," (e.g., ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"opti.tpl"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"opti.games"}],"). (domain requires multi-approval on git)"]}],"\n",["$","li",null,{"children":["Authoritative NS naming: ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"ns1.."}]," A ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"100.64.X.254"}],"."]}],"\n",["$","li",null,{"children":["Default DNS TTLs:","\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"SOA minimum/negative TTL: 300s"}],"\n",["$","li",null,{"children":"A/AAAA/CNAME defaults: 300s"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"children":"Zone SOA template (example):"}],"\n"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-dns","children":"$$ORIGIN opti.tpl.\n@ IN SOA ns1.opti.tpl. admin.opti.tpl. (\n 2025081301 ; serial (YYYYMMDDNN)\n 12h ; refresh\n 15m ; retry\n 2w ; expire\n 300 ; minimum/negative TTL\n)\n IN NS ns1.opti.tpl.\nns1 IN A 100.64.1.254\n"}]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Resolution: Each LAN runs a recursive resolver that is authoritative for its own zones. For remote zones, LAN resolvers MUST use stub/forwarding based on published NS records over the VPN. DNS over UDP/TCP is acceptable; DNS-over-TLS between LAN resolvers is RECOMMENDED."}],"\n",["$","li",null,{"children":"DNS update flow: internal subdomain records are managed locally by each LAN; only TLD ownership and delegation live in the shared Git."}],"\n"]}],"\n",["$","h3",null,{"id":"4-pki-standard-step-ca","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#4-pki-standard-step-ca","children":["$","span",null,{"className":"icon icon-link"}]}],"4) PKI Standard (step-ca)"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Root CA: offline, used only to sign LAN-specific intermediates (subordinate CAs)."}],"\n",["$","li",null,{"children":["Key algorithms:","\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Root: ECDSA P-256 or Ed25519 (hardware-protected if possible, cold storage)"}],"\n",["$","li",null,{"children":"Intermediate: ECDSA P-256 (validity ≤ 5 years)"}],"\n",["$","li",null,{"children":"Leaf certs: ECDSA P-256 (validity ≤ 397 days)"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"children":["Name Constraints on intermediates MUST restrict issuance to:","\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":["Permitted DNS suffixes: ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"*.{lan}.{tld}"}]," that the LAN owns (or registered domain on git)"]}],"\n",["$","li",null,{"children":["Permitted IP ranges: the LAN’s ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}]]}],"\n"]}],"\n"]}],"\n",["$","li",null,{"children":["Required EKUs: ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"serverAuth"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"clientAuth"}]," as appropriate. mTLS is the default between infra nodes."]}],"\n",["$","li",null,{"children":["Revocation: CRL and OCSP MUST be published (HTTP over VPN). Example OCSP: ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"http://ocsp.opti.tpl/"}],"."]}],"\n",["$","li",null,{"children":"ACME: LAN step-ca SHOULD expose ACME for automated issuance."}],"\n",["$","li",null,{"children":"Example step-ca bootstrap:"}],"\n"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-bash","children":"step ca bootstrap --ca-url https://ca.opti.tpl --fingerprint \n"}]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Example issuance:"}],"\n"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-bash","children":"step certificate create vpn.opti.tpl vpn.opti.tpl.crt vpn.opti.tpl.key \\\n --san vpn.opti.tpl --profile server --not-after 397d\n"}]}],"\n",["$","h3",null,{"id":"5-vpn--routing-standard","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#5-vpn--routing-standard","children":["$","span",null,{"className":"icon icon-link"}]}],"5) VPN & Routing Standard"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"WireGuard is RECOMMENDED; peers form a full or partial mesh."}],"\n",["$","li",null,{"children":"Port: UDP 51820 by default, but you may publish a different listening port to Git. Persistent keepalive 25s for NAT traversal."}],"\n",["$","li",null,{"children":["Interface naming: ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"wg-pwan"}],"."]}],"\n",["$","li",null,{"children":["AllowedIPs MUST include each peer LAN’s ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}],". Example peer entry:"]}],"\n"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-ini","children":"[Interface]\nAddress = 100.64.1.2/32\nPrivateKey = \nListenPort = 51820\n\n[Peer]\nPublicKey = \nEndpoint = 203.0.113.10:51820\nAllowedIPs = 100.64.2.0/24\nPersistentKeepalive = 25\n"}]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":["DNS traffic between LANs SHOULD traverse the VPN. Optionally, run DNS-over-TLS between ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".254"}]," nodes on port 853."]}],"\n",["$","li",null,{"children":["For larger meshes, BGP with FRR MAY be used to exchange ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}]," routes; communities can encode LAN IDs."]}],"\n"]}],"\n",["$","h3",null,{"id":"6-gitops-governance","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#6-gitops-governance","children":["$","span",null,{"className":"icon icon-link"}]}],"6) GitOps Governance"]}],"\n",["$","p",null,{"children":"Repository layout (authoritative source of truth):"}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-text","children":"repo/\n allocations/ # IPs & LAN registry\n lans.yaml\n tlds/ # Root TLD ownership & delegation\n tpl.yaml\n games.yaml\n dns-policies/ # Global defaults (TTL, templates)\n pki/ # Root CA policy, intermediate metadata\n security/ # Baselines, exceptions\n CODEOWNERS\n .github/workflows/validate.yml\n"}]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"All PRs MUST be signed (GPG/Sigstore) and require ≥2 approvals."}],"\n",["$","li",null,{"children":["CI MUST validate:","\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":["No overlapping ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}]," allocations"]}],"\n",["$","li",null,{"children":"TLD delegations refer to registered LANs"}],"\n",["$","li",null,{"children":"Name Constraints match declared zones and subnets"}],"\n",["$","li",null,{"children":"DNS zone templates compile"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"children":"DNS resolvers sync read-only from this repo at an interval (e.g., every 10m) with integrity verification (commit pinning)."}],"\n"]}],"\n",["$","h3",null,{"id":"7-security-baseline","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#7-security-baseline","children":["$","span",null,{"className":"icon icon-link"}]}],"7) Security Baseline"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"MFA for repo access; least-privileged CODEOWNERS per directory."}],"\n",["$","li",null,{"children":"Secrets managed via SOPS or Vault; no private keys stored in Git."}],"\n",["$","li",null,{"children":"Time sync (NTP/Chrony) on all nodes; clock skew < 100ms for TLS sanity."}],"\n",["$","li",null,{"children":"Host hardening: automatic updates, minimal services, firewall defaults deny inbound except VPN/DNS/OCSP."}],"\n",["$","li",null,{"children":"mTLS REQUIRED for inter-LAN admin APIs."}],"\n",["$","li",null,{"children":"Root CA material stored offline, preferably in an HSM or encrypted removable media with dual control."}],"\n"]}],"\n",["$","h3",null,{"id":"8-observability--slos","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#8-observability--slos","children":["$","span",null,{"className":"icon icon-link"}]}],"8) Observability & SLOs"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Metrics: DNS qps, NXDOMAIN rate, forward latency, cache hit ratio; VPN peers up/down, handshake age; CA issuance count, failure rate."}],"\n",["$","li",null,{"children":"Logs: DNS query logs (sampled), step-ca issuance/revocation logs, WireGuard events."}],"\n",["$","li",null,{"children":"Traces: optional for admin APIs."}],"\n",["$","li",null,{"children":["SLOs:","\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Resolver availability ≥ 99.9%"}],"\n",["$","li",null,{"children":"Median cross-LAN DNS resolve time ≤ 100ms, 95th ≤ 300ms"}],"\n",["$","li",null,{"children":"CA issuance success ≥ 99%"}],"\n"]}],"\n"]}],"\n",["$","li",null,{"children":["Alerts: loss of any ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".254"}]," resolver, route flap, stale OCSP/CRL, CI policy violations."]}],"\n"]}],"\n",["$","h3",null,{"id":"9-backup--dr","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#9-backup--dr","children":["$","span",null,{"className":"icon icon-link"}]}],"9) Backup & DR"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Back up: step-ca intermediate keys (encrypted), issuance DB, OCSP/CRL state, WireGuard keys, and local DNS data not in Git."}],"\n",["$","li",null,{"children":"Git is the source of truth for allocations, delegations, and policies. Regularly mirror and sign tags."}],"\n",["$","li",null,{"children":"Test restoring a LAN from scratch quarterly (tabletop + live drills)."}],"\n"]}],"\n",["$","h2",null,{"id":"standard-operating-procedures-sops","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#standard-operating-procedures-sops","children":["$","span",null,{"className":"icon icon-link"}]}],"Standard Operating Procedures (SOPs)"]}],"\n",["$","h3",null,{"id":"sop-a-onboard-a-new-lan","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#sop-a-onboard-a-new-lan","children":["$","span",null,{"className":"icon icon-link"}]}],"SOP A: Onboard a New LAN"]}],"\n",["$","ol",null,{"children":["\n",["$","li",null,{"children":["Request allocation via PR to ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"allocations/lans.yaml"}]," with:","\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":["LAN id, owner contacts, requested ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}]]}],"\n",["$","li",null,{"children":["Declared zones (e.g., ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"acme.tpl"}],", ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"acme.games"}],")"]}],"\n"]}],"\n"]}],"\n",["$","li",null,{"children":["After approval, CI assigns ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}]," and records LAN id."]}],"\n",["$","li",null,{"children":"Generate intermediate CSR on the LAN and submit to root CA operators:"}],"\n"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-bash","children":"step ca init --name \"acme-subCA\" --provisioner admin --ssh --deployment-type standalone\nstep certificate create \"Acme LAN Intermediate\" acme-int.crt acme-int.key \\\n --profile intermediate-ca --no-password --insecure\nstep certificate sign acme-int.crt --ca --ca-key \\\n --not-after 5y --template name-constraints.tpl\n"}]}],"\n",["$","ol",null,{"start":"4","children":["\n",["$","li",null,{"children":["Install intermediate and configure ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"step-ca"}]," with ACME and mTLS profiles."]}],"\n",["$","li",null,{"children":["Bring up DNS at ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".254"}]," with authoritative zones for approved ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"lan.tld"}]," pairs."]}],"\n",["$","li",null,{"children":["Establish VPN peerings to at least two existing LANs; advertise your ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"/24"}],"."]}],"\n",["$","li",null,{"children":["Submit PRs to ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"tlds/*.yaml"}]," adding NS delegation ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"ns1.acme."}]," for each zone."]}],"\n",["$","li",null,{"children":"Run conformance tests (see Validation) and attach results to the PR."}],"\n",["$","li",null,{"children":"After merge, announce readiness; peers will learn delegations on next sync."}],"\n"]}],"\n",["$","h3",null,{"id":"sop-b-add-a-new-tld","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#sop-b-add-a-new-tld","children":["$","span",null,{"className":"icon icon-link"}]}],"SOP B: Add a New TLD"]}],"\n",["$","ol",null,{"children":["\n",["$","li",null,{"children":["Open PR to ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"tlds/.yaml"}]," proposing the TLD and its initial authoritative LAN(s)."]}],"\n",["$","li",null,{"children":"Provide rationale, intended use, and security considerations."}],"\n",["$","li",null,{"children":"CI validates and reviewers approve; on merge, all LAN resolvers sync the new TLD map."}],"\n",["$","li",null,{"children":["Authoritative LANs create zones and publish ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"ns1.."}]," A records."]}],"\n"]}],"\n",["$","h3",null,{"id":"sop-c-enroll-a-host-with-certificates","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#sop-c-enroll-a-host-with-certificates","children":["$","span",null,{"className":"icon icon-link"}]}],"SOP C: Enroll a Host with Certificates"]}],"\n",["$","ol",null,{"children":["\n",["$","li",null,{"children":"On the host, bootstrap trust to your LAN CA:"}],"\n"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-bash","children":"step ca bootstrap --ca-url https://ca.acme.tpl --fingerprint \n"}]}],"\n",["$","ol",null,{"start":"2","children":["\n",["$","li",null,{"children":"Obtain a certificate via ACME or JWK provisioner:"}],"\n"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-bash","children":"step ca certificate host1.acme.tpl host1.crt host1.key --san host1.acme.tpl --profile server\n"}]}],"\n",["$","ol",null,{"start":"3","children":["\n",["$","li",null,{"children":["Configure auto-renewal with ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"step-agent"}],"."]}],"\n"]}],"\n",["$","h3",null,{"id":"sop-d-compromise-of-a-subordinate-ca","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#sop-d-compromise-of-a-subordinate-ca","children":["$","span",null,{"className":"icon icon-link"}]}],"SOP D: Compromise of a Subordinate CA"]}],"\n",["$","ol",null,{"children":["\n",["$","li",null,{"children":["Immediately remove the LAN’s delegations from ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"tlds/*.yaml"}]," via emergency PR (fast-track policy)."]}],"\n",["$","li",null,{"children":"Revoke the intermediate; publish updated CRL and OCSP."}],"\n",["$","li",null,{"children":"Rotate WireGuard keys and mTLS secrets for the affected LAN."}],"\n",["$","li",null,{"children":"Issue a clean intermediate with strict Name Constraints; re-enroll hosts."}],"\n",["$","li",null,{"children":"Post-incident review and policy updates."}],"\n"]}],"\n",["$","h3",null,{"id":"sop-e-change-management","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#sop-e-change-management","children":["$","span",null,{"className":"icon icon-link"}]}],"SOP E: Change Management"]}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Normal changes via signed PRs, with CI passing and ≥2 approvals."}],"\n",["$","li",null,{"children":"Emergency changes allowed for security incidents; MUST be followed by a post-change PR and review within 24 hours."}],"\n"]}],"\n",["$","h2",null,{"id":"validation--conformance","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#validation--conformance","children":["$","span",null,{"className":"icon icon-link"}]}],"Validation & Conformance"]}],"\n",["$","p",null,{"children":"LANs SHOULD run a standard test suite before go-live and periodically:"}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-bash","children":"# DNS\ndig +short @100.64.X.254 ns1..\ndig +tcp .. A\n\n# Cross-LAN resolution\ndig +time=2 +retry=1 ..\n\n# TLS\nstep certificate inspect https://service.. --bundle\n\n# VPN\nwg show wg-pwan | grep handshake\n\n# Policy\n./ci/validate-allocations && ./ci/validate-name-constraints\n"}]}],"\n",["$","p",null,{"children":"Conformance results SHOULD be archived with change PRs."}],"\n",["$","h2",null,{"id":"example-policy-artifacts","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#example-policy-artifacts","children":["$","span",null,{"className":"icon icon-link"}]}],"Example Policy Artifacts"]}],"\n",["$","h3",null,{"id":"example-allocationslansyaml","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#example-allocationslansyaml","children":["$","span",null,{"className":"icon icon-link"}]}],"Example ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"allocations/lans.yaml"}]]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-yaml","children":"lans:\n - id: opti\n subnet: 100.64.1.0/24\n dns: 100.64.1.254\n zones: [opti.tpl, opti.games]\n - id: whatscs\n subnet: 100.64.2.0/24\n dns: 100.64.2.254\n zones: [whatscs.tpl]\n"}]}],"\n",["$","h3",null,{"id":"example-tldstplyaml","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#example-tldstplyaml","children":["$","span",null,{"className":"icon icon-link"}]}],"Example ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"tlds/tpl.yaml"}]]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-yaml","children":"tld: tpl\nauthoritative:\n - lan: opti\n ns: ns1.opti.tpl\n - lan: whatscs\n ns: ns1.whatscs.tpl\n"}]}],"\n",["$","h3",null,{"id":"example-dns-over-tls-between-resolvers-optional","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#example-dns-over-tls-between-resolvers-optional","children":["$","span",null,{"className":"icon icon-link"}]}],"Example DNS-over-TLS between resolvers (optional)"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-ini","children":"# stunnel or knot-resolver tls_forward\n[dns-tls]\nclient = yes\naccept = 127.0.0.1:853\nconnect = 100.64.2.254:853\nverifyChain = yes\nCAfile = /etc/ssl/certs/pwan-root.pem\n"}]}],"\n",["$","h3",null,{"id":"71-firewall-baseline--port-matrix","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#71-firewall-baseline--port-matrix","children":["$","span",null,{"className":"icon icon-link"}]}],"7.1) Firewall Baseline & Port Matrix"]}],"\n",["$","p",null,{"children":"Default posture: deny inbound, allow established/related, allow necessary outbound to VPN peers, Git, NTP, and OCSP/CRL."}],"\n",["$","div",null,{"className":"my-4 overflow-x-auto","children":["$","table",null,{"children":[["$","thead",null,{"children":["$","tr",null,{"children":[["$","th",null,{"children":"Role"}],["$","th",null,{"children":"Inbound (from)"}],["$","th",null,{"children":"Outbound (to)"}]]}]}],["$","tbody",null,{"children":[["$","tr",null,{"children":[["$","td",null,{"children":["Resolver/Authoritative ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".254"}]]}],["$","td",null,{"children":["53/udp,53/tcp from ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"100.64.0.0/10"}],"; 853/tcp (optional DoT) from ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"100.64.0.0/10"}]]}],["$","td",null,{"children":["53/udp,tcp and 853/tcp to peer ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".254"}],"; 80/443 to OCSP/CRL over VPN"]}]]}],["$","tr",null,{"children":[["$","td",null,{"children":["VPN Endpoint ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".2"}]]}],["$","td",null,{"children":"51820/udp (or Git-published port) from peer endpoints"}],["$","td",null,{"children":"51820/udp to peer endpoints"}]]}],["$","tr",null,{"children":[["$","td",null,{"children":["CA/OCSP ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".253"}]]}],["$","td",null,{"children":["443/tcp (ACME, mTLS APIs) from ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"100.64.0.0/10"}],"; 80/tcp or 443/tcp for OCSP/CRL from ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"100.64.0.0/10"}]]}],["$","td",null,{"children":"Git 443/tcp; NTP 123/udp; optional syslog/metrics"}]]}],["$","tr",null,{"children":[["$","td",null,{"children":"General Servers"}],["$","td",null,{"children":"service ports as declared in LAN policy"}],["$","td",null,{"children":["to resolvers ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".254"}],", CA ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":".253"}],", and peers as needed"]}]]}]]}]]}]}],"\n",["$","p",null,{"children":"Notes:"}],"\n",["$","ul",null,{"children":["\n",["$","li",null,{"children":"Publish any non-standard VPN ports to Git or Vault so peers can reach you."}],"\n",["$","li",null,{"children":"Prefer DNS-over-TLS between resolvers for confidentiality across VPN."}],"\n",["$","li",null,{"children":"Rate-limit and log inbound DNS to mitigate abuse."}],"\n"]}],"\n",["$","h2",null,{"id":"ci-workflow-example","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#ci-workflow-example","children":["$","span",null,{"className":"icon icon-link"}]}],"CI Workflow Example"]}],"\n",["$","p",null,{"children":"Minimal CI to validate allocations, delegations, and templates on PRs."}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-yaml","children":"name: validate\non:\n pull_request:\n branches: [ main ]\njobs:\n policy-checks:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v4\n with:\n fetch-depth: 0\n - name: Set up Python\n uses: actions/setup-python@v5\n with:\n python-version: '3.11'\n - name: Install deps\n run: |\n pip install -r ci/requirements.txt || true\n - name: Validate allocations\n run: |\n ./ci/validate-allocations\n - name: Validate TLD delegations\n run: |\n ./ci/validate-tlds\n - name: Validate name constraints\n run: |\n ./ci/validate-name-constraints\n - name: Lint DNS templates\n run: |\n ./ci/lint-dns-templates\n"}]}],"\n",["$","h2",null,{"id":"name-constraints-templates","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#name-constraints-templates","children":["$","span",null,{"className":"icon icon-link"}]}],"Name-Constraints Templates"]}],"\n",["$","h3",null,{"id":"openssl-v3-extension-for-an-intermediate-ca-example","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#openssl-v3-extension-for-an-intermediate-ca-example","children":["$","span",null,{"className":"icon icon-link"}]}],"OpenSSL v3 extension for an intermediate CA (example)"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-ini","children":"[ v3_ca_nc ]\nbasicConstraints = critical, CA:true, pathlen:0\nkeyUsage = critical, keyCertSign, cRLSign\nnameConstraints = critical,\n permitted;DNS:.acme.tpl,\n permitted;DNS:.acme.games,\n permitted;IP:100.64.50.0/24\n"}]}],"\n",["$","p",null,{"children":["Usage with ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"openssl ca"}]," or ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"openssl x509 -extfile -extensions v3_ca_nc"}]," when signing the intermediate. Replace ",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"acme"}]," and subnet with your LAN."]}],"\n",["$","h3",null,{"id":"step-ca-intermediate-template-name-constraintstpl","children":[["$","a",null,{"aria-hidden":"true","tabIndex":"-1","href":"#step-ca-intermediate-template-name-constraintstpl","children":["$","span",null,{"className":"icon icon-link"}]}],"step-ca intermediate template (",["$","code",null,{"className":"rounded bg-surface-700 px-1 py-0.5 text-[0.9em]","children":"name-constraints.tpl"}],")"]}],"\n",["$","pre",null,{"className":"overflow-x-auto rounded-lg bg-surface-800 p-3","children":["$","code",null,{"className":"language-json","children":"{\n \"subject\": {{ toJson .Subject }},\n \"sans\": {{ toJson .SANs }},\n \"x509\": {\n \"basicConstraints\": { \"isCA\": true, \"maxPathLen\": 0 },\n \"nameConstraints\": {\n \"critical\": true,\n \"permittedDNSDomains\": [\".acme.tpl\", \".acme.games\"],\n \"permittedIPRanges\": [\"100.64.50.0/24\"]\n }\n }\n}\n"}]}],"\n",["$","p",null,{"children":"For dynamic constraints, parameterize via claims or provisioner templates. Ensure the permitted domains match the LAN’s approved zones in Git."}]]