Part 1 of fixing the wildcard-shadowing properly (no IPv6 suppression).
The IoT VLAN advertises a global IPv6 prefix (RA/SLAAC), but the Atom Echo ran v4-only because ESPHome defaults IPv6 off. This enables it (network: enable_ipv6: true) so the device is a proper dual-stack citizen and gets a real global IPv6.
Why this is the prerequisite: the DNS bug is that shelly-ble-proxy-1.iot.renner.uno has no AAAA, so v6 queries fall through to the *.renner.uno Cloudflare wildcard → the public reverse proxy. opentofu/dns_renner_uno.tf already fixes this exact failure for udm/captive by pinning an explicit unifi_dns_record AAAA. Once the device has a real IPv6, we pin the proxy's AAAA to its own address — the name then resolves to the device, not the proxy, and IPv6 is provided, not suppressed.
Takes effect on the next USB re-flash (no OTA on this device by design). Part 2 (the unifi_dns_record AAAA) follows once the re-flashed device reports its global v6.
Part 1 of fixing the wildcard-shadowing properly (no IPv6 suppression).
The IoT VLAN advertises a global IPv6 prefix (RA/SLAAC), but the Atom Echo ran **v4-only** because ESPHome defaults IPv6 off. This enables it (`network: enable_ipv6: true`) so the device is a proper dual-stack citizen and gets a real global IPv6.
**Why this is the prerequisite:** the DNS bug is that `shelly-ble-proxy-1.iot.renner.uno` has no AAAA, so v6 queries fall through to the `*.renner.uno` Cloudflare wildcard → the public reverse proxy. `opentofu/dns_renner_uno.tf` already fixes this exact failure for `udm`/`captive` by pinning an explicit `unifi_dns_record` AAAA. Once the device has a real IPv6, we pin the proxy's AAAA to **its own address** — the name then resolves to the device, not the proxy, and IPv6 is *provided*, not suppressed.
**Takes effect on the next USB re-flash** (no OTA on this device by design). Part 2 (the `unifi_dns_record` AAAA) follows once the re-flashed device reports its global v6.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
The IoT VLAN advertises a global IPv6 prefix (RA/SLAAC), but the Atom Echo
ran v4-only because ESPHome defaults IPv6 off. Enable it so the device is a
proper dual-stack citizen of the segment and has a real global IPv6.
This is the prerequisite for the DNS-side fix: once the device has a real
AAAA, a `unifi_dns_record` AAAA for shelly-ble-proxy-1.iot.renner.uno can be
pinned to it (same pattern as the existing udm/captive records in
opentofu/dns_renner_uno.tf), so the name resolves to the device instead of
falling through to the *.renner.uno proxy wildcard.
Takes effect on the next USB re-flash (no OTA on this device by design).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part 1 of fixing the wildcard-shadowing properly (no IPv6 suppression).
The IoT VLAN advertises a global IPv6 prefix (RA/SLAAC), but the Atom Echo ran v4-only because ESPHome defaults IPv6 off. This enables it (
network: enable_ipv6: true) so the device is a proper dual-stack citizen and gets a real global IPv6.Why this is the prerequisite: the DNS bug is that
shelly-ble-proxy-1.iot.renner.unohas no AAAA, so v6 queries fall through to the*.renner.unoCloudflare wildcard → the public reverse proxy.opentofu/dns_renner_uno.tfalready fixes this exact failure forudm/captiveby pinning an explicitunifi_dns_recordAAAA. Once the device has a real IPv6, we pin the proxy's AAAA to its own address — the name then resolves to the device, not the proxy, and IPv6 is provided, not suppressed.Takes effect on the next USB re-flash (no OTA on this device by design). Part 2 (the
unifi_dns_recordAAAA) follows once the re-flashed device reports its global v6.🤖 Generated with Claude Code