01
Add a node, keep the same pools.
Paid extra DHCP-only nodes are identical. Relays at that site point at the new node. The pool lives in Postgres, not on a box you fail over.
Software-only DDI
DDI without the appliance tax.
IPAM as the source of truth. Scale-out DHCP behind a VIP. Keep Active Directory or BIND, or serve Lattice-managed zones.
02
Reservations the DHCP plane cannot violate.
IPAM is the source of truth. A lease is a row. The ack path does not wait on DNS.
03
Signed entitlements. No per-node licenses.
One file, scoped by managed IPs. Admins upload it in the console; every dhcpd process reads the same cap.
In the product today
Built in the Lattice DDI repo. Not a roadmap slide.
Console
Operator console
Svelte UI in lattice-api. Overview, plan, subnets, leases, DNS, classes, nodes, cluster, audit, license, help. Roles: admin, operator, readonly.
Operations overview
Live counts, utilization bars, derived alerts (exhausted pools, stale dhcpd, outbox lag), recent leases. Refreshes from Postgres every 8s.
Helpdesk leases
Header search for IP, MAC, hostname, CIDR, or DNS. Force-release returns the address; DNS delete goes through the outbox.
DHCP, IPAM, DNS
DHCPv4 and DHCPv6
Discover/Offer, Request/Ack/Nak, Release, Decline, Inform. Option 82 / RFC 3527. PXE next-server and boot file. v6 IA_NA and IA_PD without exploding a /64. Quarantine on DHCPDECLINE.
Client classes and options
Match vendor-class, user-class, or MAC prefix. Class-scoped pools. DHCP options as JSON. NTP option 42 on the subnet row.
DNS: keep yours, or serve ours
Adapters write A/PTR into AD, BIND, or PowerDNS. lattice-dns is an authoritative nameserver for Lattice-managed zones (AXFR, IXFR, hidden primary). Pick one mode per zone. Ack never waits on DNS.
HA and license
HA is a paid topology
Community is one Ubuntu node. Paid may run three-node HA (Patroni, one VIP). Same tarball. Relays point at the VIP. Health is HTTP /readyz, not UDP/67.
Tokens and audit
lattice_live_ secrets, SHA-256 at rest, shown once. Append-only audit with before/after. Rate limits. CSP on the console origin.
Integrations
HMAC-signed webhooks. NetBox prefix export and create-missing import. OpenAPI 3.1. Prometheus /metrics. JSON logs.
One source of truth. Identical nodes.
Prefixes, pools, reservations, live leases. Community is one Ubuntu node. Paid HA is three identical nodes behind one VIP: console, DHCP, lattice-dns, and Patroni. DNS after the ack. DHCP stays on your network.
Relays and browsers use that host. Postgres, console, dhcpd, and lattice-dns run together. Community UI is HTTP :8080. lattice-dns :53 only if you publish a Lattice-managed zone.
Relays and browsers use the VIP. Console, dhcpd, and lattice-dns run on every node. Postgres is Patroni — three copies, one writer. Same tarball as community. Two nodes cannot form a quorum.
From purchase to first Ack
One tarball. Lab is make up. Production is lattice-install. DHCP stays on your network.
Air-gap works.
01
Account and entitlement
Signup issues a community file. Paid tiers get the same binaries with a higher IP cap. Upload it in the console.
02
One linux tarball
amd64 or arm64. Same package for community and paid. Verify SHA256SUMS. Air-gap works.
03
lattice-install
Ubuntu 22.04 or 24.04. Size the VM from the table. Community: one node. Paid: that, or three-node HA with a VIP.
04
First subnet, then one DNS mode
Keep AD or BIND, publish lattice-dns, or run it as a hidden primary. Do not mix modes on the same zone.