Docs
Install it. Open the console. Point relays.
Written for Windows / AD administrators. Production is Ubuntu and lattice-install. Fleet is a different tarball. Console Help links into these docs.
Start here
Windows / ADSSH vs RDP, WinSCP, sudo. Skip if you already live on Ubuntu.Install prerequisitesSize the VM, static IPv4, NTP, ports. Then the installer.Production installCluster tarball and lattice-install. Not Fleet.UpgradeFour scenarios. Fleet first, then rolling cluster. Do not skip more than two cluster cuts under this Fleet.First loginBrowser on your PC. Paste the first token. Cert warning is expected.First subnetPrefix, subnet, exclude the gateway, add a pool, prove an Ack.Relaysip helper-address. Empty trusted relays drop relayed DHCP.
More than one cluster
FleetDifferent tarball (`fleet-install`, HTTP :8090). No dhcpd. Community cap is two clusters. Three-node cluster HA is in the HA docs, not Fleet.Start
- If you administer Windows (and not Linux)/docs/windows-adminSSH vs RDP, WinSCP, sudo, netplan. The default reader is a Windows / AD administrator.
- Install prerequisites/docs/install-prerequisitesSize the Ubuntu VM, static IPv4, NTP, ports, entitlement. Do this before lattice-install.
- Administrator manual/docs/adminInstall Lattice, design the addressing plan, point relays, pick a DNS mode, mint tokens.
- Production install/docs/deployCluster tarball and lattice-install. Not Fleet.
- Console user manual/docs/userOperators, helpdesk, and readonly. Reservations, leases, search. You do not SSH.
- First login/docs/first-loginOpen the console in a browser. Paste the first admin token. The certificate warning is expected.
- First subnet/docs/first-subnetPrefix, subnet, exclude the gateway, add a pool, prove an Ack. A Microsoft scope is several Lattice objects.
- DHCP relays/docs/relaysip helper-address unicasts Discover with giaddr. Empty trusted relays drop relayed packets.
- DHCP lease time and planning/docs/dhcp-capacityRFC T1 renewals. Lattice default is one day. Cap is managed IPs, not packets per second.
- lattice-dhcptest/docs/dhcptestProve an Ack from the node. Discover, Request, one lease row.
- Migrate from Microsoft, ISC, or Kea/docs/migrateNo -All on Get-DhcpServerv4*. ClientId is hyphenated MAC. Bring scopes as prefixes, pools, and reservations.
- HTTPS/docs/tlsCommunity UI is HTTPS on 443. Replace the self-signed cert.
- License and entitlement/docs/licenseSigned lattice.entitlement.json, not a serial. Meter is leased + reserved + quarantined + assigned.
- Environment and listen ports/docs/configNetwork intent lives in Postgres. Process settings are LATTICE_* env vars.
Console
- Helpdesk/docs/helpdeskSearch the MAC. History for who held an IP or sat on a switch port. Work queues. Operator token only — no SSH.
- Overview screen/docs/overviewOperations home. Counts and alerts from Postgres, not from a single dhcpd process.
- Console map/docs/consoleOverview · Addresses · Leases · Work · DNS · More. Addresses is /plan. Search lands on the object. Occupancy is History (IP, MAC, hostname, switch port).
- Search/docs/searchType an IP, MAC, hostname, CIDR, or DNS name in the console. Hits open the object — lease, map, prefix, NAK story. Cisco dotted MAC works.
- Tokens and roles/docs/tokenslattice_live_ secrets, SHA-256 at rest, shown once. admin / operator / readonly.
- History/docs/historyWho held this IP, where this MAC has been, which NICs this hostname used, what sat on this switch port. Lease rows, not Audit.
- Nodes and /readyz/docs/nodesdhcpd heartbeats in the node table. VIP health-checks HTTP, not UDP/67.
- Audit log/docs/auditIPAM mutations with before/after. Occupancy is History, not here. Readonly can look.
- Tenants/docs/tenantsList, create, rename. Admin only for writes.
IPAM & DHCP
- Addresses (prefixes and subnets)/docs/planNested prefixes on Addresses. DHCP or tracking-only. Open a subnet to mark an address.
- Reservations/docs/reservationsThis MAC always gets this IP via DHCP. Not a static NIC. Not an exclude.
- Subnet screen/docs/subnetOne page for gateway, timers, NTP, PXE, DDNS, pools, reservations, excludes, options, and live leases.
- Excludes (Don’t offer)/docs/excludesGateway and VIP must be Don’t offer. Lattice will Offer .1 if it is in the pool.
- Helpdesk leases/docs/leasesSearch by MAC, IP, hostname, client-id, subnet, or state. Force-release returns the address.
- Client classes/docs/classesMatch clients, attach options, optionally pin a pool to a class.
- DHCP options/docs/optionsOption code plus JSON payload on the subnet, or on a client class. Optional vendor.
- NTP for DHCP clients/docs/ntpSubnet field “NTP servers” becomes DHCPv4 option 42. Host clocks are a different problem.
- PXE next-server and boot file/docs/pxeSubnet fields become DHCPv4 siaddr and options 66/67. Server-id stays option 54.
- IPv6/docs/ipv6IA_NA and IA_PD without exploding a /64 into inventory rows.
- Decline quarantine/docs/quarantineDHCPDECLINE parks the address. It is not a forever blacklist.
- Hostnames and FQDNs/docs/hostnamesOption 12 is sanitized to one DNS-safe label. FQDN is zone plus that label.
- Delete a subnet/docs/delete-subnetLeftover occupancy blocks DELETE unless you check Force. That drops remaining lease rows and tells DNS to remove live names.
DNS
- How DNS works with Lattice/docs/dns-howA laptop is a stub. It asks DHCP option 6. It does not discover lattice-dns.
- lattice-dns (authoritative)/docs/dnsAuthoritative for Lattice-managed zones only. Recursion is off. Option 6 is not this binary.
- lattice-dns embedded (hidden primary)/docs/embedded-dnsAuthoritative DNS for internal Lattice-managed zones. Not public DNS. Recursion off.
- Static DNS records/docs/static-recordsManual A, AAAA, CNAME, MX, SRV, CAA on /dns. Separate from lease-derived names.
Integrations
- DNS and CMDB integrations/docs/integrationsHub for AD keytab, BIND TSIG, PowerDNS, webhooks, NetBox. Keep the DNS you already run.
- GSS-TSIG to Active Directory/docs/ad-ddnsKeep AD. Keytab on the worker. Community includes AD DDNS. HA is the paid wall.
- TSIG to BIND/docs/bind-ddnsCommunity includes BIND TSIG. Point the adapter at your existing nameservers.
- HTTP API/docs/api/api/v1. Bearer lattice_live_…. OpenAPI 3.1.
- PowerDNS HTTP API/docs/powerdnsWorker PATCHes rrsets. Create the zone in PowerDNS first.
- Webhooks/docs/webhooksSigned outbox HTTP after DNS. Never rolls back the lease.
- NetBox/docs/netboxLattice is master for DHCP. Import only creates missing prefixes.
Fleet
- Lattice Fleet/docs/fleetDifferent tarball. fleet-install, HTTP :8090, no dhcpd. Community cap 2 clusters.
- Enroll a cluster/docs/fleet-enrollRegister the cluster in Fleet, paste the one-time token on the cluster, start lattice-fleet-agent. Outbound HTTPS only.
- Fleet console/docs/fleet-consoleHealth of every cluster, the live cluster screens, one inbox, search and occupancy History across sites. Sign in with the admin token or SSO.
- Fleet SSO and roles/docs/fleet-identityOIDC into the Fleet console. fleet_admin, fleet_operator, fleet_readonly. Break-glass is time-limited and audited.
- Fleet high availability/docs/fleet-haTwo or more lattice-fleet nodes, one Fleet Postgres, load balancer on /readyz. Not cluster Patroni.
- Fleet entitlement/docs/fleet-licenselattice.fleet.entitlement/v1. Meter is max_clusters. Missing file is Community, two clusters. Support follows the file for the broken thing.
Operations
- HA is not Microsoft DHCP failover/docs/haThree Ubuntu VMs, one Postgres, one VIP. Not Microsoft DHCP failover. Same L2 is the trio only.
- systemd units/docs/systemdlattice-api, lattice-dhcpd, lattice-worker. Unique LATTICE_NODE_NAME on every dhcpd.
- Upgrade Lattice/docs/upgradeFour scenarios. Fleet first, then rolling cluster. Do not skip more than two cluster cuts under this Fleet.
- Kubernetes examples/docs/k8sExample manifests. Postgres stays external. Not a hosted Lattice cluster.
- VIP/docs/vipRelays point at one address. Health-check HTTP /readyz. Starter HA uses keepalived for UDP. Clients do not need that L2.
- Postgres/docs/postgresShared writer is HA for dhcpd. Backup the database, not a lease file on the box.
- Backup Postgres/docs/backupState is in the database. Nodes do not have a special lease file you must copy.
- PgBouncer/docs/pgbouncerOptional. Session pool for api/worker. dhcpd keeps a direct DSN because of LISTEN/NOTIFY.
- Clock sync/docs/clockLease expiry, offer TTL, GSS-TSIG, and Patroni all assume clocks agree. UTC everywhere.
- Secret refs (env and file)/docs/secretsTSIG, keytabs, PowerDNS tokens, webhook HMAC. Lattice stores a ref, not the secret, after create.
- Pool exhaustion/docs/pool-exhaustionDiscover gets no Offer. NAK. lattice_pool_free near 0.
- Logs, metrics, SIEM/docs/observabilityJSON on stdout, Prometheus /metrics, signed webhooks. Lattice does not speak syslog or SNMP.
- Stuck DNS outbox/docs/outboxlattice_outbox_lag climbing. A/PTR missing after Ack. Lease is still valid.
- Metrics/docs/metricsPrometheus text on /metrics for api, dhcpd, and worker.
- Runbooks/docs/runbooksAdd/drain dhcpd, Postgres failover, clock, pools, outbox. Shared DB, no pairwise failover.
Troubleshoot
- Troubleshooting/docs/troubleshootingNo Offer, NAK, DNS lag, clock, trusted relays. Diag on the VM.
- Discover gets no Offer/docs/no-offerSilence, not NAK. Usually giaddr, trusted relays, no pool, or dhcpd not ready.
- Client got a NAK/docs/nakRequest committed only if the IP is still yours to have. Logs say request nak.