An accepted ADR delegated this to an issue that was never filed
ADR-0042 decision 5 records that this estate has no reachable UDP endpoint — the WAN address is ISP-assigned by DHCP and there is no dynamic DNS — and closes with "Recorded as blocking, owned by its own issue." docs/runbooks/open-the-remote-path.md §0 says "do not start §1 until that is answered", and docs/runbooks/build-the-jumpbox.md calls the endpoint "the part that is still open". No open issue mentions dynamic DNS, DDNS, or a static WAN address. This is the issue.
It blocks #442 outright: a WireGuard peer with nowhere to send its first packet is a config file.
The two answers
- A static WAN address from the ISP. A recurring cost, and the first one on the estate's buy list that is a subscription rather than a part.
roadmap.md's "Everything still to buy" gets a row if this is chosen.
- Dynamic DNS. A provider handed a continuously-updated pointer to the house, from
morpheus (pfSense's built-in client) or from a timer on prometheus. No money; a third party learns the WAN address on every change, and a record in a zone the estate does not run becomes part of the remote path's trust.
A third, which #447 already describes for a different reason: a VPS with a static address as the relay. If either #447 or this is taken, they should be read together — a relay's address answers this question for free.
Done when
One of the three is chosen in a short ADR or an addendum to ADR-0042, the buy list is edited in the same commit if it costs money, and open-the-remote-path.md §0's blocker sentence is replaced by the answer.
Refs #442, #447, #436.
An accepted ADR delegated this to an issue that was never filed
ADR-0042 decision 5 records that this estate has no reachable UDP endpoint — the WAN address is ISP-assigned by DHCP and there is no dynamic DNS — and closes with "Recorded as blocking, owned by its own issue."
docs/runbooks/open-the-remote-path.md§0 says "do not start §1 until that is answered", anddocs/runbooks/build-the-jumpbox.mdcalls the endpoint "the part that is still open". No open issue mentions dynamic DNS, DDNS, or a static WAN address. This is the issue.It blocks #442 outright: a WireGuard peer with nowhere to send its first packet is a config file.
The two answers
roadmap.md's "Everything still to buy" gets a row if this is chosen.morpheus(pfSense's built-in client) or from a timer onprometheus. No money; a third party learns the WAN address on every change, and a record in a zone the estate does not run becomes part of the remote path's trust.A third, which #447 already describes for a different reason: a VPS with a static address as the relay. If either #447 or this is taken, they should be read together — a relay's address answers this question for free.
Done when
One of the three is chosen in a short ADR or an addendum to ADR-0042, the buy list is edited in the same commit if it costs money, and
open-the-remote-path.md§0's blocker sentence is replaced by the answer.Refs #442, #447, #436.