diff --git a/manifests/aerodrome/dns/dns-stack.yaml b/manifests/aerodrome/dns/dns-stack.yaml
new file mode 100644
index 0000000..c180d02
--- /dev/null
+++ b/manifests/aerodrome/dns/dns-stack.yaml
@@ -0,0 +1,389 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dns
+---
+# -------------------------------------------------------------
+# Persistent Volumes for Technitium & Pi-hole (Longhorn)
+# -------------------------------------------------------------
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: technitium-config-pvc
+  namespace: dns
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pihole-etc-pvc
+  namespace: dns
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pihole-dnsmasq-pvc
+  namespace: dns
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 2Gi
+---
+# -------------------------------------------------------------
+# Technitium DNS Server (Authoritative, Recursive & DoH Upstream)
+# -------------------------------------------------------------
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: technitium-dns
+  namespace: dns
+  labels:
+    app: technitium-dns
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: technitium-dns
+  template:
+    metadata:
+      labels:
+        app: technitium-dns
+    spec:
+      containers:
+      - name: technitium-dns
+        image: technitium/dns-server:latest
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: DNS_SERVER_ADMIN_PASSWORD
+          value: "snarfnetadmin"
+        - name: DNS_SERVER_FORWARDERS
+          value: "https://dns.quad9.net/dns-query,https://1.1.1.1/dns-query"
+        - name: DNS_SERVER_PREFER_IPV6
+          value: "false"
+        - name: DNS_SERVER_LOG_USING_LOCAL_TIME
+          value: "true"
+        - name: DNS_SERVER_SSO_ENABLED
+          value: "true"
+        - name: DNS_SERVER_SSO_METADATA_ADDRESS
+          value: "https://authentik.snarfnet.net/application/o/technitium/.well-known/openid-configuration"
+        - name: DNS_SERVER_SSO_CLIENT_ID
+          value: "technitium-dns-oidc"
+        - name: DNS_SERVER_SSO_CLIENT_SECRET
+          value: "SnarfNetTechnitiumOIDC2026!"
+        - name: DNS_SERVER_SSO_SCOPES
+          value: "openid,profile,email"
+        - name: DNS_SERVER_SSO_ALLOW_SIGNUP
+          value: "true"
+        - name: DNS_SERVER_SSO_ALLOW_SIGNUP_ONLY_FOR_MAPPED_USERS
+          value: "false"
+        - name: DNS_SERVER_SSO_GROUP_MAP
+          value: "authentik Admins:Administrators"
+        ports:
+        - name: dns-udp
+          containerPort: 53
+          protocol: UDP
+        - name: dns-tcp
+          containerPort: 53
+          protocol: TCP
+        - name: web-http
+          containerPort: 5380
+          protocol: TCP
+        volumeMounts:
+        - name: technitium-config
+          mountPath: /etc/dns
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 1000m
+            memory: 1024Mi
+      volumes:
+      - name: technitium-config
+        persistentVolumeClaim:
+          claimName: technitium-config-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: technitium-service
+  namespace: dns
+  labels:
+    app: technitium-dns
+spec:
+  type: ClusterIP
+  selector:
+    app: technitium-dns
+  ports:
+  - name: dns-udp
+    port: 53
+    targetPort: 53
+    protocol: UDP
+  - name: dns-tcp
+    port: 53
+    targetPort: 53
+    protocol: TCP
+  - name: web-http
+    port: 5380
+    targetPort: 5380
+    protocol: TCP
+---
+# -------------------------------------------------------------
+# Pi-hole (Front-end Filtering, Caching & Ad-blocking)
+# -------------------------------------------------------------
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pihole
+  namespace: dns
+  labels:
+    app: pihole
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: pihole
+  template:
+    metadata:
+      labels:
+        app: pihole
+    spec:
+      containers:
+      - name: pihole
+        image: pihole/pihole:latest
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: TZ
+          value: "America/New_York"
+        - name: FTLCONF_rateLimit
+          value: "0/0"
+        - name: FTLCONF_dns_upstreams
+          value: "technitium-service.dns.svc.cluster.local#53"
+        - name: FTLCONF_dns_listeningMode
+          value: "all"
+        - name: FTLCONF_dns_dnssec
+          value: "false"
+        - name: FTLCONF_webserver_port
+          value: "80"
+        - name: FTLCONF_webserver_api_password
+          value: "snarfnetadmin"
+        - name: WEBPASSWORD
+          value: "snarfnetadmin"
+        ports:
+        - name: dns-udp
+          containerPort: 53
+          protocol: UDP
+        - name: dns-tcp
+          containerPort: 53
+          protocol: TCP
+        - name: http
+          containerPort: 80
+          protocol: TCP
+        volumeMounts:
+        - name: pihole-etc
+          mountPath: /etc/pihole
+        - name: pihole-dnsmasq
+          mountPath: /etc/dnsmasq.d
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 1000m
+            memory: 1024Mi
+      volumes:
+      - name: pihole-etc
+        persistentVolumeClaim:
+          claimName: pihole-etc-pvc
+      - name: pihole-dnsmasq
+        persistentVolumeClaim:
+          claimName: pihole-dnsmasq-pvc
+---
+# -------------------------------------------------------------
+# MetalLB LoadBalancer VIP on Port 53 (Aerodrome Primary: 140.44.4.32)
+# -------------------------------------------------------------
+apiVersion: v1
+kind: Service
+metadata:
+  name: pihole-dns-vip
+  namespace: dns
+  annotations:
+    metallb.universe.tf/loadBalancerIPs: 140.44.4.36
+    metallb.universe.tf/allow-shared-ip: "aerodrome-dns-key"
+  labels:
+    app: pihole
+spec:
+  type: LoadBalancer
+  selector:
+    app: pihole
+  ports:
+  - name: dns-udp
+    port: 53
+    targetPort: 53
+    protocol: UDP
+  - name: dns-tcp
+    port: 53
+    targetPort: 53
+    protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pihole-web-vip
+  namespace: dns
+  annotations:
+    metallb.universe.tf/loadBalancerIPs: 140.44.4.36
+    metallb.universe.tf/allow-shared-ip: "aerodrome-dns-key"
+  labels:
+    app: pihole
+spec:
+  type: LoadBalancer
+  selector:
+    app: pihole
+  ports:
+  - name: web-http
+    port: 80
+    targetPort: 80
+    protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: technitium-web-vip
+  namespace: dns
+  annotations:
+    metallb.universe.tf/loadBalancerIPs: 140.44.4.36
+    metallb.universe.tf/allow-shared-ip: "aerodrome-dns-key"
+  labels:
+    app: technitium-dns
+spec:
+  type: LoadBalancer
+  selector:
+    app: technitium-dns
+  ports:
+  - name: web-http
+    port: 5380
+    targetPort: 5380
+    protocol: TCP
+---
+# -------------------------------------------------------------
+# Traefik ForwardAuth Middleware (Authentik Outpost)
+# -------------------------------------------------------------
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authentik-forwardauth
+  namespace: dns
+spec:
+  forwardAuth:
+    address: http://authentik-server.infra.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+    - X-authentik-username
+    - X-authentik-groups
+    - X-authentik-email
+    - X-authentik-name
+    - X-authentik-uid
+    trustForwardHeader: true
+---
+# -------------------------------------------------------------
+# Pi-hole Web Ingress (TLS + Authentik ForwardAuth)
+# -------------------------------------------------------------
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: pihole-ingress
+  namespace: dns
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: dns-authentik-forwardauth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: pihole.snarfnet.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: pihole-web-vip
+            port:
+              number: 80
+  - host: pihole1.snarfnet.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: pihole-web-vip
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - pihole.snarfnet.net
+    - pihole1.snarfnet.net
+    secretName: tls-snarfnet-wildcard
+---
+# -------------------------------------------------------------
+# Technitium Web Ingress (TLS + Native OIDC)
+# -------------------------------------------------------------
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: technitium-ingress
+  namespace: dns
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: technitium.snarfnet.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: technitium-web-vip
+            port:
+              number: 5380
+  - host: dns1.snarfnet.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: technitium-web-vip
+            port:
+              number: 5380
+  tls:
+  - hosts:
+    - technitium.snarfnet.net
+    - dns1.snarfnet.net
+    secretName: tls-snarfnet-wildcard
+
+
diff --git a/manifests/spaceport/dns/dns-stack.yaml b/manifests/spaceport/dns/dns-stack.yaml
new file mode 100644
index 0000000..e055a3e
--- /dev/null
+++ b/manifests/spaceport/dns/dns-stack.yaml
@@ -0,0 +1,378 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dns
+---
+# -------------------------------------------------------------
+# Persistent Volumes for Technitium & Pi-hole (Longhorn)
+# -------------------------------------------------------------
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: technitium-config-pvc
+  namespace: dns
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pihole-etc-pvc
+  namespace: dns
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pihole-dnsmasq-pvc
+  namespace: dns
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 2Gi
+---
+# -------------------------------------------------------------
+# Technitium DNS Server (Authoritative, Recursive & DoH Upstream)
+# -------------------------------------------------------------
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: technitium-dns
+  namespace: dns
+  labels:
+    app: technitium-dns
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: technitium-dns
+  template:
+    metadata:
+      labels:
+        app: technitium-dns
+    spec:
+      containers:
+      - name: technitium-dns
+        image: technitium/dns-server:latest
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: DNS_SERVER_ADMIN_PASSWORD
+          value: "snarfnetadmin"
+        - name: DNS_SERVER_FORWARDERS
+          value: "https://dns.quad9.net/dns-query,https://1.1.1.1/dns-query"
+        - name: DNS_SERVER_PREFER_IPV6
+          value: "false"
+        - name: DNS_SERVER_LOG_USING_LOCAL_TIME
+          value: "true"
+        - name: DNS_SERVER_SSO_ENABLED
+          value: "true"
+        - name: DNS_SERVER_SSO_METADATA_ADDRESS
+          value: "https://authentik.snarfnet.net/application/o/technitium/.well-known/openid-configuration"
+        - name: DNS_SERVER_SSO_CLIENT_ID
+          value: "technitium-dns-oidc"
+        - name: DNS_SERVER_SSO_CLIENT_SECRET
+          value: "SnarfNetTechnitiumOIDC2026!"
+        - name: DNS_SERVER_SSO_SCOPES
+          value: "openid,profile,email"
+        - name: DNS_SERVER_SSO_ALLOW_SIGNUP
+          value: "true"
+        - name: DNS_SERVER_SSO_ALLOW_SIGNUP_ONLY_FOR_MAPPED_USERS
+          value: "false"
+        - name: DNS_SERVER_SSO_GROUP_MAP
+          value: "authentik Admins:Administrators"
+        ports:
+        - name: dns-udp
+          containerPort: 53
+          protocol: UDP
+        - name: dns-tcp
+          containerPort: 53
+          protocol: TCP
+        - name: web-http
+          containerPort: 5380
+          protocol: TCP
+        volumeMounts:
+        - name: technitium-config
+          mountPath: /etc/dns
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 1000m
+            memory: 1024Mi
+      volumes:
+      - name: technitium-config
+        persistentVolumeClaim:
+          claimName: technitium-config-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: technitium-service
+  namespace: dns
+  labels:
+    app: technitium-dns
+spec:
+  type: ClusterIP
+  selector:
+    app: technitium-dns
+  ports:
+  - name: dns-udp
+    port: 53
+    targetPort: 53
+    protocol: UDP
+  - name: dns-tcp
+    port: 53
+    targetPort: 53
+    protocol: TCP
+  - name: web-http
+    port: 5380
+    targetPort: 5380
+    protocol: TCP
+---
+# -------------------------------------------------------------
+# Pi-hole (Front-end Filtering, Caching & Ad-blocking)
+# -------------------------------------------------------------
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pihole
+  namespace: dns
+  labels:
+    app: pihole
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: pihole
+  template:
+    metadata:
+      labels:
+        app: pihole
+    spec:
+      containers:
+      - name: pihole
+        image: pihole/pihole:latest
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: TZ
+          value: "America/New_York"
+        - name: FTLCONF_rateLimit
+          value: "0/0"
+        - name: FTLCONF_dns_upstreams
+          value: "technitium-service.dns.svc.cluster.local#53"
+        - name: FTLCONF_dns_listeningMode
+          value: "all"
+        - name: FTLCONF_dns_dnssec
+          value: "false"
+        - name: FTLCONF_webserver_port
+          value: "80"
+        - name: FTLCONF_webserver_api_password
+          value: "snarfnetadmin"
+        - name: WEBPASSWORD
+          value: "snarfnetadmin"
+        ports:
+        - name: dns-udp
+          containerPort: 53
+          protocol: UDP
+        - name: dns-tcp
+          containerPort: 53
+          protocol: TCP
+        - name: http
+          containerPort: 80
+          protocol: TCP
+        volumeMounts:
+        - name: pihole-etc
+          mountPath: /etc/pihole
+        - name: pihole-dnsmasq
+          mountPath: /etc/dnsmasq.d
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 1000m
+            memory: 1024Mi
+      volumes:
+      - name: pihole-etc
+        persistentVolumeClaim:
+          claimName: pihole-etc-pvc
+      - name: pihole-dnsmasq
+        persistentVolumeClaim:
+          claimName: pihole-dnsmasq-pvc
+---
+# -------------------------------------------------------------
+# MetalLB LoadBalancer VIP on Port 53 (Spaceport Secondary: 140.44.4.65)
+# -------------------------------------------------------------
+apiVersion: v1
+kind: Service
+metadata:
+  name: pihole-dns-vip
+  namespace: dns
+  annotations:
+    metallb.universe.tf/loadBalancerIPs: 140.44.4.65
+    metallb.universe.tf/allow-shared-ip: "spaceport-dns-key"
+  labels:
+    app: pihole
+spec:
+  type: LoadBalancer
+  selector:
+    app: pihole
+  ports:
+  - name: dns-udp
+    port: 53
+    targetPort: 53
+    protocol: UDP
+  - name: dns-tcp
+    port: 53
+    targetPort: 53
+    protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pihole-web-vip
+  namespace: dns
+  annotations:
+    metallb.universe.tf/loadBalancerIPs: 140.44.4.65
+    metallb.universe.tf/allow-shared-ip: "spaceport-dns-key"
+  labels:
+    app: pihole
+spec:
+  type: LoadBalancer
+  selector:
+    app: pihole
+  ports:
+  - name: web-http
+    port: 80
+    targetPort: 80
+    protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: technitium-web-vip
+  namespace: dns
+  annotations:
+    metallb.universe.tf/loadBalancerIPs: 140.44.4.65
+    metallb.universe.tf/allow-shared-ip: "spaceport-dns-key"
+  labels:
+    app: technitium-dns
+spec:
+  type: LoadBalancer
+  selector:
+    app: technitium-dns
+  ports:
+  - name: web-http
+    port: 5380
+    targetPort: 5380
+    protocol: TCP
+---
+# -------------------------------------------------------------
+# Traefik ForwardAuth Middleware (Authentik Outpost)
+# -------------------------------------------------------------
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authentik-forwardauth
+  namespace: dns
+spec:
+  forwardAuth:
+    address: https://authentik.snarfnet.net/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+    - X-authentik-username
+    - X-authentik-groups
+    - X-authentik-email
+    - X-authentik-name
+    - X-authentik-uid
+    trustForwardHeader: true
+---
+# -------------------------------------------------------------
+# Pi-hole Web Ingress (TLS + Authentik ForwardAuth)
+# -------------------------------------------------------------
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: pihole-ingress
+  namespace: dns
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.middlewares: dns-authentik-forwardauth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: pihole2.snarfnet.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: pihole-web-vip
+            port:
+              number: 80
+  - host: pihole3.snarfnet.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: pihole-web-vip
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - pihole2.snarfnet.net
+    - pihole3.snarfnet.net
+    secretName: tls-snarfnet-wildcard
+---
+# -------------------------------------------------------------
+# Technitium Web Ingress (TLS + Native OIDC)
+# -------------------------------------------------------------
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: technitium-ingress
+  namespace: dns
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: dns2.snarfnet.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: technitium-web-vip
+            port:
+              number: 5380
+  tls:
+  - hosts:
+    - dns2.snarfnet.net
+    secretName: tls-snarfnet-wildcard
+
+