feat(pihole): add knoe.dev GKE service records for LAN split-horizon DNS

Adds dnsmasq address= directives for all active knoe.dev GKE endpoints
so LAN clients (morgana, Pi nodes) resolve them without hitting external DNS.

Records added:
  mcp.0.knoe.dev   → 8.232.93.14    (knoe-mcp GCE LB)
  auth.0.knoe.dev  → 34.36.71.141   (knoe-auth GCE LB)
  api.0.knoe.dev   → 34.120.221.5   (supabase-kong GCE LB)
  db.0.knoe.dev    → 34.120.221.5   (supabase-kong GCE LB)
  app.0.knoe.dev   → 34.120.221.5   (supabase-kong GCE LB)

auth.0.knoe.dev was previously resolving to 34.120.221.5 (wrong — supabase LB)
causing the knoe-auth managed cert to be stuck Provisioning for 20 days.
Correct IP is 34.36.71.141. Also update auth.0.knoe.dev in external DNS
(name.com) to unblock the GCP managed cert.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible.sh

@@ -4,6 +4,11 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 export ANSIBLE_CONFIG="${ROOT_DIR}/ansible.cfg"
 
+# macOS: prevent Objective-C runtime from aborting forked worker processes.
+# Required for WinRM connections (pywinrm/requests uses Foundation framework
+# internally; macOS kills forked children that load ObjC before fork()).
+export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+
 # Defaults
 MODE="fg"                           # fg|bg
 PLAYBOOK="infrastructure/playbooks/site.yml"

infrastructure/inventory/group_vars/pihole.yml

@@ -11,3 +11,20 @@ lan_reverse_zone: "0.0.10.in-addr.arpa"
 # Performance/resilience knobs
 pihole_dns_forward_max: 300
 pihole_sqlite_busy_timeout: 5000
+
+# knoe.dev GKE service records — resolved on the LAN via dnsmasq address= directives.
+# These bypass split-horizon Samba DNS which only knows prole.org, not knoe.dev.
+# GCE LB IPs are stable (manually assigned via GCP static IP reservation).
+#
+# To update: change the IP below and re-run the pihole_dns role.
+# Source of truth: `kubectl get ingress -A` on the knoe-dev-0 cluster.
+knoe_dev_dns_records:
+  # knoe-mcp: company knowledge MCP  (GCE LB: knoe-mcp-knoeledge-mcp)
+  - { name: "mcp.0.knoe.dev",    ip: "8.232.93.14"  }
+  # knoe-auth: identity / OIDC / Kerberos token exchange  (GCE LB: knoe-auth)
+  - { name: "auth.0.knoe.dev",   ip: "34.36.71.141"  }
+  # supabase kong: API gateway + DB proxy  (GCE LB: supabase-kong)
+  - { name: "api.0.knoe.dev",    ip: "34.120.221.5"  }
+  - { name: "db.0.knoe.dev",     ip: "34.120.221.5"  }
+  # Knoey web app
+  - { name: "app.0.knoe.dev",    ip: "34.120.221.5"  }

infrastructure/inventory/group_vars/workstations_windows/vars.yml

@@ -0,0 +1,6 @@
+# WinRM connection vars for Windows GPU workstations (morgoth, fairyland).
+# ansible_user and ansible_password are set per-host in host_vars/ because
+# the two machines use different local accounts.
+# Passwords are vaulted in group_vars/all/prole_vault.yml as:
+#   vault_winrm_password_morgoth   (chrisfu@morgoth)
+#   vault_winrm_password_fairyland (minecraft@fairyland)

infrastructure/inventory/host_vars/fairyland.prole.org.yml

@@ -0,0 +1,3 @@
+# WinRM credentials for fairyland.prole.org (Windows GPU workstation)
+ansible_user: minecraft
+ansible_password: "{{ vault_winrm_password_fairyland }}"

infrastructure/inventory/host_vars/morgoth.prole.org.yml

@@ -0,0 +1,3 @@
+# WinRM credentials for morgoth.prole.org (Windows GPU workstation)
+ansible_user: chrisfu
+ansible_password: "{{ vault_winrm_password_morgoth }}"

infrastructure/inventory/hosts.ini

@@ -79,8 +79,8 @@ zinfandel.prole.org ansible_user=chrisfu ansible_ssh_private_key_file=~/.ssh/id_
 # Kerberos via Windows SSPI — no MIT Kerberos client needed.
 # If not joined, add ansible_winrm_transport=kerberos after domain-joining.
 [workstations_windows]
-morgoth.prole.org    ansible_user=chrisfu ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore
+morgoth.prole.org    ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore ansible_winrm_scheme=http ansible_port=5985
-fairyland.prole.org  ansible_user=chrisfu ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore
+fairyland.prole.org  ansible_connection=winrm ansible_winrm_transport=ntlm ansible_winrm_server_cert_validation=ignore ansible_winrm_scheme=http ansible_port=5985
 
 [workstations_windows:vars]
 ansible_become=false

infrastructure/playbooks/windows_ollama_models.yml

@@ -122,8 +122,15 @@
           ''
         }
 
-        & $ollama show $modelName *> $null
+        # Check model existence without letting $ErrorActionPreference = Stop
-        $modelExists = ($LASTEXITCODE -eq 0)
+        # treat a non-zero exit code as a terminating error.
+        $modelExists = $false
+        try {
+          $null = & $ollama show $modelName 2>&1
+          $modelExists = ($LASTEXITCODE -eq 0)
+        } catch {
+          $modelExists = $false
+        }
 
         if ($modelExists -and ($recordedHash -eq $desiredHash)) {
           Write-Output "unchanged: $modelName already matches managed Modelfile"

infrastructure/roles/pihole_dns/tasks/main.yml

@@ -23,6 +23,15 @@
     mode: "0644"
   notify: restart pihole-FTL
 
+- name: Configure knoe.dev GKE service records (LAN split-horizon)
+  ansible.builtin.template:
+    src: 06-knoe-dev.conf.j2
+    dest: /etc/dnsmasq.d/06-knoe-dev.conf
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart pihole-FTL
+
 - name: Read current Pi-hole FTL DB journal mode (WAL?)
   ansible.builtin.command: sqlite3 /etc/pihole/pihole-FTL.db "PRAGMA journal_mode;"
   register: pihole_journal

infrastructure/roles/pihole_dns/templates/06-knoe-dev.conf.j2

@@ -0,0 +1,11 @@
+# knoe.dev GKE service records
+# Injected by Ansible pihole_dns role — do not edit manually.
+#
+# GKE app cluster (knoe-dev-0) LB endpoints:
+#   mcp.*       → 8.232.93.14   (knoe-mcp GCE LB)
+#   auth.*      → 34.36.71.141  (knoe-auth GCE LB)
+#   api.*, db.* → 34.120.221.5  (supabase-kong GCE LB)
+
+{% for record in knoe_dev_dns_records %}
+address=/{{ record.name }}/{{ record.ip }}
+{% endfor %}