Hi lejeczek,

...

...

gee.. I'm really hopping in the dark here. Is such a scenario a topic covered somewhere in IPA docs(I failed to find)?

So, you want to move from FROM.HERE realm to UP.FROM.HERE realm? Or you still want to use FROM.HERE realm and just deploy new machines in up.from.here DNS domain?

For the former you have to stand up a completely new deployment. For the latter you can just enroll machines from up.from.here to FROM.HERE.

many thanks, Would "completely new deployment" also be the case (now I'm thinking I phrased that wrongly before, I was going down a level instead of up) if change(realm) was: DOWN.FROM.HERE => FROM.HERE ?

Yes, you would also need a new deployment to change the realm from DOWN.FROM.HERE to FROM.HERE

Its actually documented and the choice for realm has to be made when starting IPA server deployment. I am certain I read somewhere changing IPA realm isn't supported. Actually, just did a quick google and its explicitly stated here

https://www.freeipa.org/page/Deployment_Recommendations

Regards, William