Reference documentation

SpatiumDDI Documentation

SpatiumDDI is an open-source, self-hosted DNS, DHCP and IP Address Management platform. It does not merely configure external servers — it runs BIND9, PowerDNS, Technitium and Kea as managed service containers, with one control plane over all three.

Install the appliance Set up DNS, DHCP and IPAM How it fits together

DNS engines: BIND9 · PowerDNS · Technitium · Windows DNS · Cloudflare · Route 53 · Azure · Google
DHCP engines: Kea · Windows DHCP
Deploy as: OS appliance · Docker Compose · Kubernetes
Telemetry: None — ever
License: Apache 2.0 · source on GitHub

Start here

New to SpatiumDDI? Install the appliance, then work the setup order.

1 Install the OS appliance Boot one ISO, answer the installer, and the full stack is on HTTPS a few minutes after the reboot — no Docker or Kubernetes to set up 2 Getting Started First login, the concepts, and the setup order that avoids re-doing work: servers → zones and scopes → subnets → addresses 3 Troubleshooting Recovery recipes: deleted agent rows, password reset, refused subnet deletes, and more

Running containers you manage yourself? Start at Docker Compose or Kubernetes instead of step 1.

Architecture & design

How the control plane, agents and data model fit together, and the conventions every surface follows.

Architecture System topology, component relationships, HA design Deployment Topologies Six reference production layouts with sizing notes Data Model Database models, relationships, field definitions API Conventions REST conventions, pagination, error format, versioning Permissions RBAC grammar, builtin roles, scope delegation Observability Logging, metrics, health dashboard, alerting Fleet Firewall Design Per-role appliance firewall policy compiled to nftables Shipped Roadmap The design context behind every feature that has landed

Feature specs

One page per subsystem — the authoritative description of what each does and why it was built that way.

IPAM Spaces, blocks, subnets, addresses, VLANs, custom fields, import and export DNS Zones, records, views, server groups, blocking lists, DNSSEC, DoT / DoH, Windows DNS DHCP Servers, scopes, pools, reservations, leases, DDNS, Windows DHCP Auth & Permissions LDAP, OIDC, SAML, RADIUS, TACACS+, roles, API tokens ACME DNS-01 Provider acme-dns-compatible endpoint for public-CA certificate issuance Migration One-shot DNS, DHCP and NetBox importers, plus the guided Windows cutover Integrations Read-only mirrors of Kubernetes, Docker, Proxmox, Tailscale, cloud and firewalls into IPAM BGP Looking Glass Receive-only GoBGP collector: sessions, routes, RPKI status at ingest Vertical Network Awareness AV-over-IP, BACnet/IP, industrial OT and DICOM registries, plus the do-not-probe flag E911 Dispatchable Location A Location Information Server: ERLs, port and subnet bindings, HELD and DHCP delivery System Admin Config, health dashboard, notifications, backup and restore, service control

Deployment

Every supported way to run it, from a single Compose host to a multi-node appliance cluster.

Install the OS Appliance Step by step: the ISO, the installer, first boot, first login, adding nodes Docker Compose Quick start, profiles, TLS, HA Kubernetes Umbrella Helm chart, HPA, Ingress / LoadBalancer, CloudNativePG + Redis Sentinel HA OS Appliance Design Why k3s, the A/B slot layout, the fleet firewall, control-plane HA internals, the build pipeline Bare Metal Compose on a host, Patroni HA Postgres overlay, the appliance path Windows Server WinRM, service accounts, firewall — the Windows-side checklist for DNS and DHCP DNS Agent Agent protocol, auto-registration, config sync

Internals & development

Driver internals for anyone reading the code, and how to build, test and contribute.

DNS Drivers BIND9, PowerDNS, Technitium and Windows DNS driver internals DHCP Drivers Kea and Windows DHCP driver internals Development Guide Coding standards, test requirements, CI pipeline Performance Testing The 24-hour university-scale load and soak plan behind the perf/ suite Perf Appliance Setup Preparing a clean single-node appliance for the suite to drive

Project

Policies, licences, and where the project lives.

Privacy No telemetry, no analytics, no phone-home — every outbound connection, what it sends, how to turn it off Third-Party Components Every bundled engine, library and OS package, with its licence and the artifact it ships in Source, Releases & Issues The project on GitHub Community Questions and discussion on Discord

Source for these pages lives in the docs/ directory of the main repository and is republished on every push to main.