servers/psmf: add psmf server docs, nginx/tailscale config, and data-sync

Document the psmf host (DNS, second tailscale netns instance, nginx
vhosts, migration plan) and add the docker-dev-22 psmf-data-sync
service plus the storage-23 pg_hba.conf entry it needs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

servers/psmf/dns-configuration.md

@@ -0,0 +1,157 @@
+## disable systemd-resolved
+
+```bash
+sudo mkdir -p /etc/systemd/resolved.conf.d
+sudo tee /etc/systemd/resolved.conf.d/disable-stub.conf <<EOF
+[Resolve]
+DNSStubListener=no
+EOF
+
+# Fix /etc/resolv.conf symlink so the box itself still resolves
+sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
+
+sudo systemctl restart systemd-resolved
+```
+
+
+## dnsmasq in ts2 namespace
+
+```bash
+sudo mkdir -p /etc/dnsmasq-ts2
+sudo tee /etc/dnsmasq-ts2/dnsmasq.conf <<'EOF'
+# Inside ts2 netns — tailscale0 is the only real interface.
+# Bind to all (namespace is isolated, so this is safe).
+no-resolv
+no-hosts
+
+# Upstreams (explicit, no /etc/resolv.conf dependency inside netns)
+server=1.1.1.1
+server=9.9.9.9
+
+# Zone
+local=/intranet/
+domain=intranet
+
+address=/psmf.intranet/100.90.25.77
+address=/psmf-new.intranet/100.90.25.77
+
+cache-size=1000
+log-facility=/var/log/dnsmasq-ts2.log
+
+user=dnsmasq
+pid-file=/run/dnsmasq-ts2.pid
+EOF
+```
+
+```bash
+# systemd-unit
+sudo tee /etc/systemd/system/dnsmasq-ts2.service <<'EOF'
+[Unit]
+Description=dnsmasq inside ts2 netns (intranet zone)
+After=network-online.target
+Wants=network-online.target
+# If you have a unit that sets up the ts2 namespace + tailscaled inside it,
+# add it here, e.g.:
+# Requires=tailscaled-ts2.service
+# After=tailscaled-ts2.service
+
+[Service]
+Type=simple
+NetworkNamespacePath=/var/run/netns/ts2
+ExecStartPre=/usr/sbin/dnsmasq --test -C /etc/dnsmasq-ts2/dnsmasq.conf
+ExecStart=/usr/sbin/dnsmasq -k -C /etc/dnsmasq-ts2/dnsmasq.conf
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+```
+
+```bash
+# validate and start
+sudo systemctl daemon-reload
+sudo systemctl enable --now dnsmasq-ts2
+sudo systemctl status dnsmasq-ts2 --no-pager
+
+
+sudo ip netns exec ts2 ss -lnup | grep :53
+sudo ip netns exec ts2 dig @127.0.0.1 psmf.intranet +short
+sudo ip netns exec ts2 dig @127.0.0.1 cloudflare.com +short
+```
+
+
+## dnsmasq in root namespace
+
+```bash
+sudo mkdir -p /etc/dnsmasq-root
+sudo tee /etc/dnsmasq-root/dnsmasq.conf <<'EOF'
+# Root netns instance. Stock dnsmasq.service must be disabled/masked
+# so it doesn't fight us for port 53.
+# systemd-resolved stub listener is disabled (see top of this file).
+
+# Only listen on these — don't grab :53 on every interface.
+bind-interfaces
+interface=br0
+interface=tailscale0
+
+# Upstreams (explicit, no /etc/resolv.conf lookup)
+no-resolv
+no-hosts
+server=1.1.1.1
+server=9.9.9.9
+
+# Zone
+local=/intranet/
+domain=intranet
+
+address=/psmf.intranet/100.90.25.77
+address=/psmf-new.intranet/100.90.25.77
+
+cache-size=1000
+log-facility=/var/log/dnsmasq-root.log
+
+user=dnsmasq
+pid-file=/run/dnsmasq-root.pid
+EOF
+```
+
+```bash
+# systemd-unit
+sudo tee /etc/systemd/system/dnsmasq-root.service <<'EOF'
+[Unit]
+Description=dnsmasq in root netns (intranet zone)
+After=network-online.target
+Wants=network-online.target
+# Make sure the stock apt dnsmasq is out of the way:
+# sudo systemctl disable --now dnsmasq
+# sudo systemctl mask dnsmasq
+
+[Service]
+Type=simple
+ExecStartPre=/usr/sbin/dnsmasq --test -C /etc/dnsmasq-root/dnsmasq.conf
+ExecStart=/usr/sbin/dnsmasq -k -C /etc/dnsmasq-root/dnsmasq.conf
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+```
+
+```bash
+# validate and start
+sudo systemctl daemon-reload
+sudo systemctl enable --now dnsmasq-root
+sudo systemctl status dnsmasq-root --no-pager
+
+# verify it's bound only on br0 + tailscale0 (not on lo, not 0.0.0.0)
+sudo ss -lnup | grep :53
+
+# smoke test against the host's own br0 / tailscale0 IP
+BR0_IP=$(ip -4 -o addr show br0        | awk '{print $4}' | cut -d/ -f1)
+TS0_IP=$(ip -4 -o addr show tailscale0  | awk '{print $4}' | cut -d/ -f1)
+dig @"$BR0_IP" psmf.intranet  +short
+dig @"$TS0_IP" psmf.intranet  +short
+dig @"$BR0_IP" cloudflare.com +short
+```