Hello list, I’m managing the network for my hackerspace, and we’re moving to FreeIPA (from plain LDAP) to manage internal and external services.

We have some services that are hosted on public, external machines (wiki, etc.) that members would authenticate to via Ipsilon OAuth2 that are under the main domain (e.g. wiki.example.org), and some internally hosted services that are under a subdomain (e.g. netbox.hq.example.org).

My plan is to have a IPA replica on the ”outside” with Ipsilon for external auth, and a couple of local replicas (one of which is the ca master). The outside replica would be connected via VPN to the internal network, to avoid opening lots of ports to the outside world.

I’m having some difficulties choosing the proper Kerberos domain, and in general putting together the ”external” world (example.org domain) and the ”internal” one (hq.example.com domain) because the DNS server on the main domain is under CloudFlare.

Would getting a new domain just for FreeIPA be advisable?

Thanks, Aljaž

-- Aljaž Srebrnič a.k.a g5pw My public key: https://g5pw.me/key Key fingerprint = 2109 8131 60CA 01AF 75EC 01BF E140 E1EE A54E E677