Glossary
Terms are listed alphabetically. Where a word has a general DNS or DHCP meaning and a narrower SpatiumDDI meaning, the definition gives the SpatiumDDI one. Examples use the Ridgeline College names from the course.
A and AAAA records. The name-to-address record types: A for IPv4, AAAA for IPv6. SpatiumDDI creates them when you save an IP with a hostname and a DNS zone.
A/B slot. The OS appliance keeps two 8 GiB root filesystems (slot A and slot B) and a shared /var. An upgrade writes the new image into the inactive slot, boots it once, and only makes it permanent if it comes up healthy. Because the database lives on the shared /var, going back to the old slot after a database migration is not safe, and SpatiumDDI refuses it unless you acknowledge it (see schema_rollback_unsafe).
About page. ⓘ About in the sidebar footer (/about): the product, the running version, the Apache-2.0 license, the NOTICE and the third-party notices. Only signed-in users can open it.
Agent. The process that runs beside a DNS or DHCP daemon in the same container (dns-bind9, dns-powerdns, dns-technitium, dhcp-kea). It registers with the control plane, long-polls for configuration, renders and applies it, keeps the last good copy, and reports health, logs and leases back. What it can’t deliver during an outage waits in its push spool.
AGENT_GROUP. The environment variable that tells a new agent which server group to join; default if it’s unset, and the group is created if it doesn’t exist. It only matters at first registration. To move a registered server, use the Server group picker in its edit form.
Agentless. A backend that SpatiumDDI drives remotely with nothing installed on it: Windows DNS and DHCP over WinRM and RFC 2136, the cloud DNS providers over their APIs, an existing Technitium server (technitium_api, experimental in 1.0) and FortiGate.
ALIAS record. A PowerDNS-only record type that acts like a CNAME at the zone apex, so example.com itself can point at another hostname.
API_BIND. The Compose setting for the host address the API port (8000) is published on: 127.0.0.1 by default, so only the Docker host reaches the API directly and everyone else goes through the web port. Widening it means narrowing TRUSTED_PROXY_CIDRS (see trusted proxy).
Audit hash chain. Every change writes an append-only audit row in the same database transaction. Each row stores a hash of its own content plus the previous row’s hash, so editing or removing a row breaks the chain. Database triggers refuse deletes and updates, a nightly job checks the rows added since its last run, and a full pass re-checks the whole chain about once a week. It’s tamper-evident, not tamper-proof.
AXFR and IXFR. Full (AXFR) and incremental (IXFR) DNS zone transfers. SpatiumDDI uses AXFR to import and compare zones; transfers from agent-managed BIND9 and Technitium groups are signed with the group’s TSIG key.
Backup peer. In Kea HA, a third Kea member with an HA Peer URL: it takes no part in the heartbeat but receives lease updates. See HA.
Beat. The single Celery scheduler that queues periodic jobs such as health sweeps, lease pulls, reconciliation and the Trash purge. A worker runs what beat schedules. Run exactly one beat.
Block. An aggregate of address space inside an IP space, such as 10.20.0.0/16 “Ridgeline campus”. It groups subnets and holds settings they inherit, such as the DNS and DHCP server groups. Blocks can nest; addresses always live in subnets.
Bootstrap key. The pre-shared DNS_AGENT_KEY or DHCP_AGENT_KEY (named SPATIUM_AGENT_KEY inside the Kea container) that an agent presents once to register, in exchange for a rotating token. Superadmins reveal it under Settings → Security → Agent bootstrap keys.
Bridge release. 2026.10.02-1, the last CalVer release and the first that knows SemVer releases are newer. An install on anything older upgrades to it first, then to 1.0.0-beta.3 or later; see the upgrade checklist.
Bundle. See ConfigBundle.
CalVer and SemVer. SpatiumDDI’s two version formats. Releases up to the bridge, 2026.10.02-1, use CalVer, YYYY.MM.DD-N, where N counts that day’s releases. From 1.0.0 they use SemVer (MAJOR.MINOR.PATCH), with pre-releases such as 1.0.0-beta.3 and release candidates 1.0.0-rc.N. Every SemVer release is newer than every CalVer one, and a pre-release never becomes latest, so you install it by pinning its version. This course targets 1.0.0-beta.3. Helm chart versions equal the tag for SemVer releases; CalVer charts drop the leading zeros (2026.9.4-1).
Catalog zone. An RFC 9432 zone that lists member zones, so secondary servers learn which zones to serve without per-zone setup. BIND9 produces and consumes catalogs, PowerDNS only produces them, Technitium can’t use them in 1.0, and BIND needs version 9.18 or later.
Certificate store. The TLS certificates and private keys SpatiumDDI holds, uploaded or issued through its Let’s Encrypt client. DNS server groups pick their DoT, DoH and DoQ certificate from it. It has its own permission, certificate_store, which the DNS Editor and Appliance Operator roles hold.
Change request. With the governance.approvals feature module on (it ships off), a matching change is queued instead of carried out. A second person with the Change Approver role, and the permission the change itself needs, approves it; nobody approves their own request.
Client class. A DHCP rule with a match expression (for example on the vendor class in option 60) and its own options. Use it to give some clients different settings, or to restrict a pool to them.
Client reachability. A DHCP server group setting that picks how Kea listens: Directly attached/mixed (raw sockets that hear broadcasts and relayed requests; the default) or Relay-only (UDP sockets that only hear relayed requests).
CNPG (CloudNativePG). The Kubernetes operator SpatiumDDI uses for highly available PostgreSQL: one primary and streaming replicas with automatic failover. The OS appliance bundles it; on your own cluster you install it before enabling it in the chart.
ConfigBundle. The driver-neutral configuration the control plane assembles for one server from the database: zones and records, or scopes, pools, reservations and options. Its SHA-256 hash is the ETag an agent compares to decide whether anything changed.
Conformity. Scheduled policy checks run against your data, such as “every subnet has an owner field”, with pass and fail results and an optional alert when a check starts failing. It is part of the compliance.conformity feature module, which ships off on a fresh install.
Control plane and data plane. The control plane (api, worker, beat, frontend, PostgreSQL and Redis) decides what the configuration should be. The data plane (BIND9, PowerDNS, Technitium, Kea, or Windows servers) answers queries and hands out leases, and keeps doing so from its cached config if the control plane is down.
Custom field. An extra field an administrator defines for spaces, blocks, subnets or addresses. A field can be required or searchable, and its value can be inherited from a parent. A Required field is enforced (422) when you create a block or subnet without it.
Data Retention. The settings page (Settings → Application → Data Retention) for how long SpatiumDDI keeps operational data before a nightly prune deletes it: DNS query and DHCP activity logs (24 hours by default), metric samples (7 days), DHCP lease history (90 days), Trash (30 days), packet captures (7 days) and deleted Fleet appliances (30 days). The audit log is never pruned.
DDNS. Dynamic DNS driven by DHCP: when a lease is handed out, SpatiumDDI picks a hostname by the subnet’s policy and publishes A/AAAA and PTR records in the same way as for a static allocation. It is off by default and turned on per subnet, block or space.
Deletion batch. The ID stamped on a soft-deleted object and everything deleted with it, such as a subnet with its DHCP scopes, reverse zone and DNS records, or a zone and its records. One Restore brings the whole batch back.
DHCP Lease Sync. The Settings switch that turns on scheduled lease polling from agentless DHCP servers such as Windows, every 15 seconds by default (10 seconds minimum). Kea doesn’t need it, because its agent streams leases.
Discovery. Optional ping and ARP sweeps that record which addresses answer on a subnet. It is off by default, turned on per subnet, limited to IPv4 subnets of /20 or smaller, and blocked by Do not probe.
DNSSEC. Signatures on DNS data that let resolvers detect forged answers. SpatiumDDI signs zones online on BIND9 and PowerDNS (Technitium signing is refused in 1.0) without ever holding the private keys; you publish the zone’s DS record at the parent yourself. Each server signs with its own keys, so signing needs a group with exactly one agent DNS server, and a zone signed on a group with more shows DNSSEC: multiple signers and raises a critical alert.
Do not probe. A flag for fragile networks, such as medical or OT segments, set on a space, block or subnet. It stops discovery, nmap and the active network tools from probing anything below it, and a child can’t switch it off.
DoT, DoH and DoQ. DNS over TLS (port 853), DNS over HTTPS (port 443, or 8443 on an appliance) and DNS over QUIC (Technitium only). You enable them per group, and they run beside plain DNS on port 53, which stays on.
Drift. A difference between what SpatiumDDI expects and what really exists. The subnet’s Sync ▾ → DNS report compares IPAM with the DNS records; a zone’s Drift tab compares SpatiumDDI’s zone with what each server actually serves.
DS record. The delegation signer record that the parent zone, usually at your registrar, publishes so resolvers trust a signed zone. A zone’s DNSSEC card lists its DS records to copy; a key rollover, including one caused by moving a signed zone to another group, needs a new DS.
Effective superadmin. A user with full access, either through the account’s superadmin flag or through a group whose role grants * on *. Both paths pass every permission check in the same way, and making someone one either way needs your step-up.
ETag long-poll. How agents receive configuration. An agent keeps a request open with the ETag of its current bundle; the control plane answers straight away when the configuration changes (woken through Redis), and returns “not modified” when the poll times out.
Experimental driver. A driver the 1.0 line ships with deliberate limits. In 1.0.0-beta.3 that’s technitium_api, the agentless Technitium driver: one server per group, zones and records only, and features outside that set are refused (422). Its server shows an Experimental badge.
External URL. The public address of the web UI, set under Settings → Branding & URL. OIDC and SAML build their redirect URLs from it, and SAML with a hosted identity provider needs it to start with https://.
Feature module. A family of features you can switch on or off under Features & Integrations, such as ui.saved_views, governance.approvals or ai.copilot. While a module is off, its menus are hidden, its API returns 404 and its scheduled jobs don’t run. A fresh install turns on 16 of the 57 modules; an upgraded install keeps the ones it had.
Fleet. The part of the appliance hub where you approve paired appliances, assign them DNS and DHCP roles, mint pairing codes, stage upgrade images and run rolling upgrades.
GSLB pool. A DNS pool: one name backed by several A or AAAA targets, each health-checked and published as an ordinary record only while it is healthy. Clients cache answers, so it isn’t a load balancer; keep its TTL short (30 seconds by default).
HA (Kea high availability). A DHCP server group in Hot Standby (one active, one passive) or Load Balancing (both active) mode runs Kea’s HA hook between the Kea members that have an HA Peer URL. A third member with a URL becomes a backup peer; one without a URL is sidelined and serves no scopes. HA covers DHCPv4 only. The partners share lease state directly and, once both run a current agent, authenticate each other with a certificate generated for the group.
in-addr.arpa and ip6.arpa. The special domains that hold reverse zones. The zone name is the network written backwards: 21.20.10.in-addr.arpa covers 10.20.21.0/24, and 20.10.in-addr.arpa would cover the whole of 10.20.0.0/16. SpatiumDDI auto-creates the reverse zone for every subnet whose DNS group or zone is set or inherited, one per /24 the subnet spans and never one enclosing zone, so Ridgeline’s Staff VLAN 21 gets 21.20.10.in-addr.arpa.
Inheritance. Blocks and subnets take their DNS group and zone, DHCP group and DDNS settings from the level above, until you turn inheritance off and pin a value. DNS and DHCP inheritance are separate switches.
Integration mirror. A read-only copy of addresses from another system (Kubernetes, Docker, Proxmox, a cloud account, UniFi, OPNsense and others) that SpatiumDDI pulls into IPAM on a schedule. SpatiumDDI never writes back, except for the opt-in active block sync. When a mirror stops seeing a host, it removes the address and its DNS records, but keeps an address an operator has edited.
Integration space audit. A read-only superadmin report (GET /api/v1/ipam/integration-space-audit) that finds addresses an integration took from another IP space on releases before 1.0.0-beta.2, with the evidence for each and the subnet it probably came from.
IP space. The top-level IPAM container, a whole address universe such as Campus. Subnets can’t overlap within one space. Separate spaces may overlap, as separate VRFs do, but each then needs its own DNS and DHCP server groups.
IPAM → DNS Reconciliation. A scheduled job, off by default and hourly once enabled, that creates DNS records IPAM expects but the DNS database is missing. It only adds.
IPAM template. A named set of values (tags, custom fields, DNS and DHCP groups, DDNS settings, and for blocks a layout of child subnets) that you stamp onto a block or subnet. Reapply pushes it again and overwrites changes made by hand.
Kea. ISC’s DHCP server, which SpatiumDDI runs as its built-in DHCP engine in the dhcp-kea container. The older ISC DHCP server (dhcpd) isn’t supported, but its configuration files can be imported.
Last-known-good config. The configuration an agent last applied successfully. The agent keeps serving it while the control plane is unreachable, and goes back to it, with a config-rejected chip, when a new configuration fails.
Lease. A temporary assignment of an address to a DHCP client, with an expiry time. SpatiumDDI mirrors leases into IPAM as dhcp rows.
Maintenance mode. A platform-wide read-only switch: every write returns 503 except for superadmins, while reads and agents carry on. Pausing one server (per-server maintenance) is separate: its agent stops applying changes but keeps reporting.
MCP. The Model Context Protocol endpoint (/api/v1/ai/mcp) that lets external AI tools use SpatiumDDI’s read-only lookup tools. It belongs to the ai.copilot feature module.
MetalLB VIP. The floating control-plane address a multi-node appliance cluster gives its web UI through MetalLB. You set a MetalLB pool and the VIP in Appliance → Network & Host; point browsers and off-cluster agents at the VIP rather than at one node.
NSEC3. The DNSSEC way of proving that a name doesn’t exist, using hashed names. SpatiumDDI’s policy editor follows RFC 9276, which recommends zero extra iterations and no salt.
Operator Copilot. The optional AI assistant, backed by an AI provider an administrator configures (which can run on-premises). It can look things up; changes it suggests are staged as proposals that a person must approve.
Option template. A named, reusable set of DHCP options that you apply to a scope or client class. If the template and the scope set the same option, the template’s value wins.
Orphan IP. An IP address deleted through the UI with Mark as Orphan. It is marked orphan rather than removed, and its DNS records and aliases leave the zone; restoring it publishes them again, or you can purge it. IP addresses don’t go to Trash.
Pairing code. An 8-digit code minted on the control plane that lets an appliance register without typing the long bootstrap key. Single-use codes expire after 15 minutes by default; persistent codes allow several claims and expire after 30 days by default.
Path A and Path B. The two ways SpatiumDDI works with Windows DNS. Path A needs no credentials: records are written over RFC 2136 and zones are read over AXFR. Path B adds WinRM credentials for creating and deleting zones and reading them without AXFR; records still go over RFC 2136. For Windows DHCP, Path A mirrors leases and scopes over WinRM, and with a DHCP Administrators account also writes scope, reservation and exclusion changes through to the server.
Pool. A range of addresses inside a DHCP scope, with a type: dynamic (offered to clients), reserved (held for static use) or excluded (never offered). Only dynamic pools are sent to Kea.
PTR record. The address-to-name record type, stored in a reverse zone. SpatiumDDI creates it alongside the A record when a reverse zone covers the address, in the most specific such zone: the PTR for print-01 (10.20.21.10) is the record 10 in 21.20.10.in-addr.arpa.
Push spool. The durable queue where a DNS or DHCP agent keeps the logs, metrics and lease events the control plane couldn’t accept, to replay on reconnect. Its server row shows Replaying … backlog while it drains, and Spool trimmed if the spool hit its cap (256 MiB by default) and dropped its oldest batches.
PXE profile. A reusable, group-level set of network-boot rules (the boot server and boot files, matched by client architecture such as BIOS or UEFI) that you attach to a DHCP scope.
RBAC. Role-based access control, group-based in SpatiumDDI: users belong to groups, groups carry roles, and roles carry permission entries made of an action, a resource type and an optional single resource. Each IPAM and DNS route checks its own resource type, so a custom role lists read on every type it should see.
Redis Sentinel. A set of Redis processes, three in the standard layout, that elect a new primary automatically. SpatiumDDI uses it for highly available Redis, which holds the task queue, caches and the channel that wakes agents when configuration changes.
Relay (IP helper). A router feature that forwards DHCP broadcasts from a client’s segment to a DHCP server elsewhere. Without a relay, a DHCP server must share a layer-2 segment with its clients.
Rendered config. The daemon’s configuration files as the agent wrote them from its bundle, such as /var/lib/spatium-dhcp-agent/rendered/kea-dhcp4.json. It is the best evidence of what the daemon is really running.
Reservation (static_dhcp). A standing DHCP rule that always gives one client, matched by MAC, the same address. In IPAM the address has status static_dhcp and needs a MAC; SpatiumDDI attaches the reservation to the subnet’s one scope, and lists it in the group’s Static Assignments.
Restore drill. A scheduled test that replays a backup destination’s newest archive into a throwaway database and runs seven checks against it, without touching the live database.
RFC 2136. The dynamic DNS update protocol, which changes individual records on a live server without editing files or restarting anything. SpatiumDDI writes records over it to BIND9 and to Windows DNS in both paths.
RPZ. Response policy zone: a BIND9 mechanism for rewriting answers, which SpatiumDDI uses for blocklists (for example answering NXDOMAIN, or a sinkhole address). It works on BIND9 groups only, and a group with blocklists can’t validate DNSSEC.
schema_rollback_unsafe. The 409 an appliance returns when you try to move a control-plane node to an older release that can’t run on the migrated database (a slot rollback, a Fleet boot change, or scheduling an older image). Resending with acknowledge_schema_rollback: true goes ahead; only do that if you’ll restore a pre-upgrade copy of the database.
Scope. Binds one IPAM subnet to one DHCP server group, with the lease time and options for that subnet; pools and reservations live inside it. A subnet has at most one scope per group, and only active scopes reach Kea.
Scrape token. PROMETHEUS_METRICS_TOKEN, the bearer token Prometheus presents to read /metrics. Any API token works too; without either, /metrics answers 401.
Server group. The object that owns DNS or DHCP configuration. A DNS group holds zones, views, ACLs and TSIG keys, and all its servers run the same driver. A DHCP group holds scopes, pools, reservations and client classes, and every member serves the same configuration.
Sign-in throttles. The budgets /auth/login checks before a password: per source address, per username and install-wide. Past one, sign-in answers 429 for up to 15 minutes. Account lockout is a separate, per-account setting.
Soft delete and Trash. Deleting a space, block, subnet, zone, record or DHCP scope hides it and moves it to Administration → Trash, where you can restore it for 30 days (Settings → Data Retention) before a nightly purge removes it. While a subnet sits in Trash, the DNS records SpatiumDDI published for its addresses are withdrawn; a restore publishes them again.
Split scope. The older Windows DHCP pattern of two servers holding one scope with their parts kept apart by exclusions or ranges, and no failover relationship. SpatiumDDI recognizes it rather than flagging it as uncoordinated, and refuses any change that would make the parts overlap.
Step-up. Confirming who you are again in the middle of a session: local users re-enter their password, SSO users an authenticator code. It guards revealing secrets, minting an API token, and creating or promoting a superadmin; five wrong answers in 15 minutes block it with 429.
Subnet. An operating network such as 10.20.21.0/24 “Staff VLAN 21”, usually one VLAN. DHCP scopes attach to subnets, and addresses are allocated inside them.
Supervisor. The spatium-supervisor process on each OS appliance. It pairs the appliance with the control plane, applies its role assignments and host settings, and runs slot upgrades and reboots.
Sync with Servers. A DNS server group action that reconciles SpatiumDDI with each server: it imports zones and records found only on a server and pushes SpatiumDDI-only ones back. It never deletes.
Time-bound grant. Extra permissions given to a group until a set time, after which they expire on their own. You create them from the group’s edit form.
Trusted proxy. A peer whose forwarded headers SpatiumDDI believes. TRUSTED_PROXY_CIDRS lists the peers whose X-Real-IP the API applies (by default the private, loopback, CGNAT and ULA ranges, which include the frontend); FRONTEND_TRUSTED_PROXY_CIDRS lists your own reverse proxy in front of the frontend. Without the second, every user behind a proxy looks like the proxy.
TSIG. Transaction signatures: a shared secret that authenticates DNS messages. Every server in a SpatiumDDI DNS group shares the group’s TSIG key for dynamic updates, and signed zone transfers use it too. The key is encrypted at rest; rotate it from the group’s Edit Group form (Rotate…), once after upgrading from 2026.09.04-1. A generated secret is shown only once.
TTL. Time to live: how many seconds resolvers may cache a record. New zones default to 3600 seconds unless you change DNS Defaults in Settings.
Uncoordinated scope. A DHCP scope that two servers hand out without coordinating: two Windows servers holding it with no failover relationship, a mixed Kea and Windows group, or a Standalone group with two or more Kea members. It raises the critical DHCP scope served uncoordinated alert.
View. A BIND9 split-horizon feature that gives different answers to the same question depending on who asks, chosen by each view’s Match clients list, lowest order first. Once a group has one view, every zone is served from inside a view, so keep a catch-all view that matches any.
Windows cutover. A guided, plan-based move off Windows DNS and DHCP, one zone or scope at a time: a parity check, a parallel run, the switch (with rollback) and a decommission checklist. It’s the migration.cutover feature module, which ships off on a fresh install.
Windows failover relationship. A Windows DHCP pairing between two servers that keeps leases in step. SpatiumDDI reads each server’s relationships, writes a covered scope to both partners, and can manage relationships from the group’s Windows DHCP failover panel over CredSSP.
Windows placement. Where a new scope goes in a group with several Windows DHCP servers: into a failover relationship, or onto one server only. Creating it on every member would hand out the same range twice, so a create with no clear placement is refused (422).
WinRM. Windows Remote Management, the remote PowerShell channel on port 5985 (HTTP) or 5986 (HTTPS). SpatiumDDI uses it for Windows DNS Path B and for Windows DHCP.
Zone. The unit of DNS ownership: a part of the namespace, such as corp.example.edu, served as one set of records by one set of servers. SpatiumDDI zones are primary, secondary, stub or forward, and forward-lookup or reverse-lookup.
Zone name scope. The pill on every zone that says whether the internet could resolve its name: Public (a delegated top-level domain, as for Ridgeline’s corp.example.edu), Private (a reserved name such as .local or .internal), Undelegated (such as .lan) or Reverse. It’s a warning, never a refusal.
Zone ↔ Server Reconciliation. A scheduled Sync with Servers across every DNS group, off by default and every 30 minutes once enabled. It only adds.
Go deeper
Section titled “Go deeper”- Getting Started glossary: the official definitions in setup-order context
- Architecture: the control plane, agents, bundles and the long-poll
- Data model: how spaces, blocks, subnets, zones and scopes relate
- Permissions model: the RBAC grammar and built-in roles
- Quick reference: the defaults and limits behind many of these terms