v0.7 · Master orchestrator — plug anywhere

Plug it in —
it runs everything.

Cerulean is the self-sufficient Trust + Network layer: Technitium DNS over HTTP API (no SSH, no TSIG), DHCP, ad-blocking, a 90-day wildcard *.<serverId>.lab.innotel.us (PKI offline → Let's Encrypt when online), internal PKI, and DNS health — with Authentik SSO and HashiCorp Vault secrets.

Get started Docs

$ git clone https://github.com/innotelinc/cerulean.git && cd cerulean && cp .env.example .env && ./scripts/setup.sh --with-technitium

DNS / DHCP / BlockTechnitium HTTP API — no SSH, no zone files

90-day wildcard*.<serverId>.lab.innotel.us — PKI offline, ACME when online

PKIinternal CA + mTLS device certificates

offline-firstDHCP + DNS + certs without internet

Trust & network, automated end-to-end.

Every certificate, zone, lease and block-list driven from one orchestrator — no SSH, no zone files, no spreadsheets.

Certificate lifecycle

Let's Encrypt via Technitium DNS-01 (+ 90-day PKI wildcard fallback) — auto-renewed and pushed to NPM.

DNS automation

Technitium authoritative zones over HTTP API: add a domain, get its zone wired — per-tenant Technitium supported.

DHCP

Scopes, leases and reservations on the same Technitium — Cerulean orchestrates the LAN.

Ad-blocking

Technitium block lists + per-domain block/allow — global toggle and live refresh.

Internal PKI

Private CA for client certificates and the offline wildcard — issue, revoke, monitor from the dashboard.

Compliance & health

Trust scoring, DNS audits, and compliance evidence — orchestrator health in one view.

Authentik SSO

Every surface behind one identity provider at auth.cerulean.innotel.us.

Vault secrets

Technitium tokens and CA keys live in HashiCorp Vault (KV v2) — resolved at runtime, never in git.

The Trust + Network layer of the stack.

Cerulean consumes Authentik (identity) and HashiCorp Vault (secrets) and provides DNS/DHCP/blocking/certificates to every other platform.

Cerulean server

API + dashboard — the master orchestrator (DHCP · DNS · certs · blocking).

Technitium DNS Server

Authoritative + recursive DNS, DHCP and ad-blocking — driven over HTTP API.

ACME + PKI

Let's Encrypt (Technitium DNS-01, upgraded from PKI when online) + internal CA — 90-day wildcard included.

Internal CA

Client-certificate issuance for device trust across the ecosystem.

# one-shot setup — bundled Technitium + wildcard + NPM hosts
$ ./scripts/setup.sh --with-technitium
>> [technitium] reachable at http://cerulean-technitium:5380
>> [server] apex srv-a3f9.lab.innotel.us · wildcard *.srv-a3f9.lab.innotel.us (PKI 90d)
>> [acme] wildcard upgraded to Let's Encrypt when online (DNS-01 via Technitium)
>> [vault] CA + Technitium secrets mirrored to HashiCorp Vault
$ cerulean cert issue api.example.com
certificate issued · auto-renewal armed

Every surface, one dashboard.

Canonical subdomains under <serverId>.lab.innotel.us, wildcard-TLS'd and SSO'd by default.

Portalcerulean.innotel.us · dashboard + REST APIlive Appapp.cerulean.innotel.us · applicationlive APIapi.cerulean.innotel.us · REST APIlive Identityauth.cerulean.innotel.us · Authentik SSO — one login for every platformlive Secretssecrets.cerulean.innotel.us · HashiCorp Vault KV v2live DNSdns.cerulean.innotel.us · Technitium zone managementlive Certificatescerts.cerulean.innotel.us · ACME + PKIlive

Roadmap.

Shipped as v0.7 — master orchestrator; fleet scoring and deeper edge integration next.

v0.7 \"Orchestrator\"

Technitium master orchestrator: DNS/DHCP/blocking, 90-day offline wildcard, server identity — SSH/BIND removed.

done

v0.8 \"Trust scoring\"

Compliance reporting, DNS health, fleet-wide trust posture.

v1.0 \"LTS\"

Security audit, hardening, docs, LTS channel.

later

Plug it in —it runs everything.