DHCP & DNS

Every network in Stratum comes with a built-in DHCP server and an authoritative DNS zone. Both run inside the agent process — there are no external daemons to configure or keep in sync. Addresses are handed to a network's endpoints (an endpoint is an IP ↔ MAC profile). This page covers pool configuration, static leases, DHCP relay, and DNS zone management.

DHCP pools

When you create a network you give it an IPv4 CIDR, and the agent registers an IPAM pool for that subnet and activates a DHCP server scoped to the network's bridge segment. Leases are allocated from the IPAM pool and released back to it on expiry.

sudo cenvero-str-ctl network create \
  --name db-net \
  --cidr 10.30.0.0/24 \
  --gateway 10.30.0.1

network create accepts --name, --cidr, and optionally --gateway, --vlan, and --tenant. (Only IPv4 CIDRs are supported.)

The DHCP server tells clients:

Option	Value
Subnet mask	derived from `--cidr`
Default gateway	`--gateway`
DNS server	the agent's gateway IP (same as `--gateway`)
Lease time	the server's lease TTL
Domain search	`<network-name>.internal`

Reservations (static leases)

Pin a specific IP to a MAC address so an endpoint always gets the same address:

sudo cenvero-str-ctl dhcp reserve \
  --network db-net \
  --mac 52:54:00:de:ad:01 \
  --ip 10.30.0.10 \
  --hostname db-primary

Reservations are reflected in DNS immediately — the hostname resolves to the reserved IP whether or not the endpoint is online.

Inspecting leases

cenvero-str-ctl dhcp leases --network db-net

MAC                  IP            HOSTNAME      EXPIRES
52:54:00:de:ad:01    10.30.0.10    db-primary    (static)
52:54:00:ab:01:02    10.30.0.21    db-replica    2h 14m

To release a lease early (e.g. before re-provisioning a workload):

sudo cenvero-str-ctl dhcp release --network db-net --mac 52:54:00:ab:01:02

DHCP relay

When a network segment does not have an agent acting as local DHCP server — for example, a physical VLAN you are bridging into the fabric — configure the agent as a relay to forward DHCP discovery packets to an upstream server:

networks:
  - name: legacy-vlan
    subnet: 192.168.10.0/24
    dhcp:
      relay: true
      relay_target: 192.168.1.50

Apply with cenvero-str-ctl config apply --file node.yaml. When relay: true, the built-in DHCP server is disabled for that network and requests are forwarded to relay_target instead.

Authoritative DNS

The agent runs a DNS server bound to the bridge addresses (the management and user bridge IPv4 addresses) rather than every interface, so the resolver is never exposed on an untrusted NIC. Every network gets its own internal zone:

Zone	Example
`<network-name>.internal`	`app-net.internal`

Endpoints receive an A record as soon as they get a DHCP lease:

web-01.app-net.internal   →  10.20.0.50
db-primary.db-net.internal →  10.30.0.10

Adding manual DNS records

sudo cenvero-str-ctl dns add \
  --network app-net \
  --name api \
  --type A \
  --value 10.20.0.55

sudo cenvero-str-ctl dns add \
  --network app-net \
  --name services \
  --type CNAME \
  --value api.app-net.internal

List records for a zone:

cenvero-str-ctl dns list --network app-net

NAME        TYPE    VALUE                    TTL
web-01      A       10.20.0.50               300
api         A       10.20.0.55               300
services    CNAME   api.app-net.internal      300

Remove a record:

sudo cenvero-str-ctl dns delete --network app-net --name api --type A

Upstream forwarders

Queries for names outside the local zone are forwarded to configurable upstream resolvers. Set them in the network definition:

networks:
  - name: app-net
    dns:
      forwarders:
        - 1.1.1.1
        - 8.8.8.8

The agent tries forwarders in order and falls back to the next on timeout. If no forwarders are configured, external names do not resolve.

Not an open resolver. Recursion (forwarding a query upstream) is gated by a client ACL. When the ACL is unset it defaults to the private and loopback ranges (127.0.0.0/8, ::1/128, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7), so only clients inside those ranges have their queries forwarded; a query from outside the allowed set is refused rather than silently forwarded. Authoritative answers for local zones are always returned regardless of the ACL.

Cross-network resolution

Endpoints on different networks can resolve each other's names if they share a forwarder chain. Configure a network to delegate another zone explicitly:

dns:
  forwarders:
    - 1.1.1.1
  delegates:
    - zone: db-net.internal
      target: 10.30.0.1