Research 033: split DNS with a VPN client #167

2026-10-07T16:38:56Z

mesh-admin commented

2026-10-07 16:38:56 +00:00

Research effort 033 (playbook 01): how a VPN client on Linux sets DNS, measured read-only on the laptop, and how a machine can resolve the mesh, a corporate network and public names at once. The client moves the resolver file aside and writes its own on every connect; the node-engine wrote the mesh file back in nine of nine sessions within 1 s to 3.5 min, after which corporate names failed for the rest of the session. Options: systemd-resolved per-link routing, adding the VPN servers, forwarding from the mesh resolvers, deferring, a local dnsmasq, replacing the client. Recommendation: on a machine that declares a VPN client only, the uplink holder runs systemd-resolved on the private address and takes the VPN file servers and domains into the tunnel link within seconds; proposed decision text with how each rule is checked. Status active; graduation is a separate step.

mesh-admin added 1 commit 2026-10-07 16:38:57 +00:00

Research 033: split DNS with a VPN client

mesh/merge-gate pass: the change touches no module of the mesh's graph

Details

mesh/repo-check pass: its merge-check.sh passed

Details

mesh/delivery delivered

Details

0ab47b9417

The laptop's VPN client replaces the mesh's resolver file on every connect and
the node-engine writes it back minutes later, so either the mesh's names or the
corporate ones fail for whole sessions. Measure how the client sets DNS and
weigh how names can be routed by domain without breaking ADR 0223's one-answer
rule.

mesh-admin commented

2026-10-07 16:39:33 +00:00

Delivery novox/hq@0ab47b9417cd — delivered since 2026-10-07T16:54:35Z

Delivery plan — builds nothing: the change touches no module of the mesh's graph

Transitions

2026-10-07 16:39 (new) → proposed (announced): novox/hq#167's head announced
2026-10-07 16:40 proposed → checked (checked): the verdict names this commit
2026-10-07 16:40 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail
2026-10-07 16:54 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move
2026-10-07 16:54 published → delivered (done): nothing for a walk to move

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/hq@0ab47b9417cd` — **delivered** since 2026-10-07T16:54:35Z **Delivery plan** — builds nothing: the change touches no module of the mesh's graph **Transitions** - 2026-10-07 16:39 (new) → proposed (announced): novox/hq#167's head announced - 2026-10-07 16:40 proposed → checked (checked): the verdict names this commit - 2026-10-07 16:40 checked → ready (accepted): the gate passed or warned, and the repository's own check did not fail - 2026-10-07 16:54 ready → published (merged): on the trunk its modules follow: merged there, and its walk opened — or nothing for a walk to move - 2026-10-07 16:54 published → delivered (done): nothing for a walk to move The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

mesh-admin merged commit 79cadf6c96 into main

2026-10-07 16:54:28 +00:00

mesh-admin deleted branch research/033-split-dns-with-a-vpn-client

2026-10-07 16:54:29 +00:00

mesh-admin referenced this pull request

2026-10-07 17:04:53 +00:00

ADR 0241 and to-be 48 §10: a machine says how its network is, and an outside writer of a mesh file is a finding #168

mesh-admin referenced this pull request

2026-10-08 21:06:04 +00:00

ADR 0267: an artifact is rebuilt only when its build source changes, and a module moves only along build dependencies on artifacts #232

Sign in to join this conversation.