What's new in this edition
This edition of the Academy, course 2026.11, targets SpatiumDDI 1.0.0-beta.3. The first edition, course 2026.9, was recorded on 2026.09.04-1. Between the two, SpatiumDDI shipped four releases and about a thousand changes on its way to 1.0, and many of them change what you see and do. If you took the first edition, or you teach it, read this page first. If you’re new, skip it and start with Set up your lab.
What changed in the course
Section titled “What changed in the course”- A five-minute tour opens the course. In SpatiumDDI in five minutes you click through a real SpatiumDDI: a subnet for a new VLAN, a DHCP scope, a printer with its DNS records, a DNS check and the audit trail. A short narrated video after it explains why DNS, DHCP and IPAM belong together. It’s a good page to send someone who hasn’t seen SpatiumDDI yet.
- Every video was re-recorded on 1.0.0-beta.3 with new, more natural narration, and every click-through walkthrough was rebuilt from the new recordings.
- Two new modules have videos and labs. 2.2 Sign-in: SSO, MFA and sessions now shows account lockout, the idle-logout warning, active sessions and two-factor enrollment, with Lab 11. 2.5 Dashboards, logs and alerts now shows DNS query logging, the query log, an alert rule and Platform Insights, with Lab 12. The course now has 13 videos and 13 labs.
- Lab numbers 11 and 12 sit in Part 2, between labs 7 and 8 and between labs 9 and 10.
./lab/check.sh allruns the labs in course order. - Lab steps changed in labs 0, 2, 3, 4, 5, 7, 8 and 9 (see below), and Lab 9 has a third check.
- The lab kit now uses the release’s own Compose file, unchanged except for the project name. The web UI, the REST API and the interactive API docs all use one address,
http://localhost:8077. - The assessments were revised for 1.0.0-beta.3, and the practice bank has new questions on the changes on this page.
Lab steps that changed
Section titled “Lab steps that changed”| Lab | What’s different |
|---|---|
| 0 · Set up your lab | The lab pins SPATIUMDDI_VERSION=1.0.0-beta.3. The API container now listens on 127.0.0.1:8000 only; use port 8077 for everything |
| 2 · DNS | The zone’s toolbar is now Refresh, a Data menu, a Zone menu and Add Record. The Drift tab of a new zone now says every server matches |
| 3 · IPAM | You no longer create a reverse zone by hand. Saving Staff VLAN 21 creates 21.20.10.in-addr.arpa for you |
| 4 · DHCP | New DHCP Scope suggests a pool: replace it with .100–.199. Routers (option 3) is already filled in and saved correctly. The excluded pool saves without a warning |
| 5 · Addresses | The gateway’s PTR record is already published, so Sync ▾ → DNS only confirms the subnet is in sync. A reservation has no scope to pick |
| 7 · RBAC | Jordan’s Allocate IP is grayed out. The refusal you look for in the audit log now comes from opening Administration → Users |
| 8 · API | Creating a token asks for your password. The interactive docs work on port 8077 while you’re signed in |
| 9 · Trash | A subnet’s DNS records stop resolving while it’s in Trash and come back when you restore it, and you prove it with dig |
Product changes you’ll notice
Section titled “Product changes you’ll notice”Releases and upgrades
Section titled “Releases and upgrades”- Version numbers changed scheme. Releases up to 2026.10.02-1 use dates (CalVer). From 1.0.0 they use SemVer (
1.0.0-beta.3, then release candidates, then1.0.0), and every SemVer release counts as newer than every dated one. - 2026.10.02-1 is the bridge. An install on an older release must upgrade to it first, then to 1.0. 2.6 Backups and upgrades has the steps.
- Betas are pre-releases. They are never tagged
latestand never offered by the in-product update check. You install one by pinning its exact version.
Everyday screens
Section titled “Everyday screens”- Most feature modules start switched off. A new installation turns on 16 of 57, so the sidebar and the dashboard are shorter. See 1.3 Finding your way around.
- The interface disables what your role can’t do, and the tooltip names the missing permission. The server still checks every request.
- Toolbars moved into menus. Zones have Data and Zone menus. Subnets have Sync, Import / Export and Tools menus, and blocks have a Tools menu with Find Free….
- An About page (the ⓘ icon next to the version) shows the version, the license and the third-party notices.
DNS, IPAM and DHCP
Section titled “DNS, IPAM and DHCP”- Reverse zones are created for subnets that inherit DNS from their block, one zone per /24 the subnet spans. The most specific zone gets each PTR record.
- New subnets publish their gateway’s PTR record. The forward record is skipped on purpose.
- Deleting a subnet now takes its DNS records offline while it waits in Trash. Restoring it publishes them again.
- The DNS drift report no longer lists the BIND9 agent’s placeholder
ns1record.
Sign-in, access and the API
Section titled “Sign-in, access and the API”- Idle sessions end after 60 minutes, on new installations too. Session Timeout and Auto-Logout Warning are under Settings → Session & Security.
- Sensitive actions ask for your password again: creating an API token, making someone a superadmin, setting up two-factor.
- Roles are checked per resource type. A custom role needs
readon each IPAM and DNS type it should see. Upgraded installs can lose reads they had before. - The interactive API docs work through the web port for a signed-in browser. Anonymous callers no longer get the version, the OpenAPI schema or
/metrics. - An API token’s Last Used now updates when the token only reads.
Running the platform
Section titled “Running the platform”- Alerting ships 58 built-in rules, including alerts for failed or stale scheduled backups and expiring credentials.
- Backups: the release’s Compose file mounts the backup volume itself, and there are ten destination kinds.
- Architecture: Compose high availability isn’t supported in 1.0, a DNS group that signs zones with DNSSEC has one signing server, and Windows DHCP failover pairs are modeled. Part 3 has the details.
Academy findings that were fixed
Section titled “Academy findings that were fixed”Recording the first edition turned up bugs, which the Academy reported to the SpatiumDDI project. They were fixed in 2026.10.02-1, so the first edition’s “From the field” notes about them are gone: the dropped Routers option, reverse zones and gateway PTRs for inheriting subnets, the blank API docs page, Last Used for read-only tokens, the unauthenticated /metrics, the commented-out backup volume, the drift placeholder and the stale backup text.
Known issues in 1.0.0-beta.3
Section titled “Known issues in 1.0.0-beta.3”Recording this edition turned up four issues that matter to you. The course works around each one and says so where it matters.
Your lab from the first edition
Section titled “Your lab from the first edition”The labs build on each other, so the simplest path is a fresh lab: run ./lab/destroy.sh in your old course folder, then get the new lab kit and run ./lab/up.sh --first-login from its folder, and work through the course again. If you reuse your old folder instead, first set SPATIUMDDI_VERSION=1.0.0-beta.3 in its lab/.env, because destroy.sh keeps that file. To practice a real upgrade instead, follow the bridge route in 2.6 Backups and upgrades: 2026.09.04-1 to 2026.10.02-1, then to 1.0.0-beta.3. The Academy lab came through that route with every lab check still passing. For a production install, the field guide’s Upgrading from 2026.09.04-1 playbook lists what changes under you.