# pi4 — 10.0.0.2

**Primary LAN DNS + primary Caddy edge.** This is the front door for every website.

- **OS:** DietPi (Debian trixie) on a Raspberry Pi 4
- **Reach it:** SSH as `root`

## What it does

1. **DNS** — every device on the LAN asks pi4 to resolve names first. mini1 (`.4`) and mini2 (`.5`) are backups.
2. **Edge** — the public internet reaches the lab through pi4. It terminates HTTPS (TLS) and forwards each `*.tomasetti.online` / `*.tomasetti.shop` name to the right host.
3. **Self-healing** — a systemd `Restart=on-failure` plus a 2-minute health-check cron restart Caddy if it ever dies.

## Key facts

- Pi-hole DNS on `:53`, unbound recursion on `:5335` (no public upstreams).
- Caddy config: `/etc/caddy/Caddyfile`, deployed from the vault via `scripts/sync-edge.ps1`.
- No DHCP here — that's mini1 (`.4`).
- The standby edge lives on mini1 (`.4`); LAN clients fail over via dual-A DNS.

## If it's down

Every site goes down. Check: is the box powered/plugged, then `systemctl status caddy`.