Accept Control D endpoint-level attribution, not per-client
Date: 2026-07-07 Status: Accepted Decision: hl-p5ck Deciders: Sean Brandt
Context
Section titled “Context”Retiring the local ctrld daemon (see ADR hl-fyy5) means Control D sees one endpoint (“Home-Firewalla”) instead of per-client identity in its activity log. The design had to decide whether to preserve per-client attribution at the upstream vendor or accept the loss and relocate that visibility.
Decision
Section titled “Decision”Accept that Control D’s activity log attributes all DNS activity to one endpoint; per-client DNS visibility is answered locally (Firewalla per-device insights today, optional unbound query-logging to ClickStack as a follow-up bead) rather than restoring per-client upstream attribution.
Rationale
Section titled “Rationale”- A shared caching forwarder structurally cannot pass per-client identity upstream: unbound’s global forward-zone cannot select per-client Control-D client-ID hostnames, and cache hits never reach Control D at all.
- Reinstating ctrld reverses the dnsmasq-overlay retirement and rebuilds the fragile multi-daemon chain implicated in the hl-hqyv incident.
- ECS support with Control D over DoT is unverified and stratifies the cache per client — not ready to ship.
Alternatives Considered
Section titled “Alternatives Considered”- Accept endpoint-level attribution; move per-client visibility local (chosen): matches the structural reality of a shared caching forwarder; keeps Control D profile-level filtering intact.
- Reinstate ctrld as DNS first hop (rejected): restores per-client attribution for cache misses only, reverses the retire decision, rebuilds the multi-daemon chain, and behind dnsmasq interception may not see real client IPs.
- EDNS Client Subnet via unbound subnetcache (rejected): unverified Control D support, fragments the shared cache per client, untested with DoT — a research spike at best.
Consequences
Section titled “Consequences”- Positive: resolver chain stays simple (dnsmasq → unbound → Control D DoT); Control D profile-level filtering/policy unaffected.
- Negative: per-client “who queried what” is no longer visible in Control D’s dashboard; relies on Firewalla per-device insights or a not-yet-built local query-logging pipeline.
- Neutral: unbound query logging (log-queries/dnstap → OTel → ClickStack) is a candidate follow-up bead, not committed work.