ADR 0196: a node asks the mesh's resolver first, and a public one only when it is silent #330

2026-10-03T19:56:33Z

jschoubben commented

2026-10-03 19:56:33 +00:00

Replaces ADR 0194's asking side. Each node's /etc/resolv.conf (existing resolv-conf module) names mesh-resolver first and a public resolver second, timeout:1 attempts:1. The mesh resolver answers .internal and forwards everything else; the public one is asked only when the mesh's is unreachable. Containers copy the machine's non-loopback resolvers, so no runtime dns.

Dropped: the systemd-resolved module and the runtime dns naming mesh-resolver. Kept from 0194: one mesh-resolver on the node every tunnel converges on, retirement of node-dns-resolver and per-node copies, a LAN's resolver not being the mesh's.

LAN devices are unaffected by this choice: they take DNS from the router, which step 3 points at itself (verified: the router answers public names correctly; the unifi module has unifi_set_network_dns).

ADR 0194 marked; connectivity §2 amended. records/index/cycle pass.

Replaces ADR 0194's asking side. Each node's `/etc/resolv.conf` (existing `resolv-conf` module) names `mesh-resolver` first and a public resolver second, `timeout:1 attempts:1`. The mesh resolver answers `.internal` and forwards everything else; the public one is asked only when the mesh's is unreachable. Containers copy the machine's non-loopback resolvers, so no runtime `dns`. Dropped: the `systemd-resolved` module and the runtime `dns` naming `mesh-resolver`. Kept from 0194: one `mesh-resolver` on the node every tunnel converges on, retirement of `node-dns-resolver` and per-node copies, a LAN's resolver not being the mesh's. LAN devices are unaffected by this choice: they take DNS from the router, which step 3 points at itself (verified: the router answers public names correctly; the `unifi` module has `unifi_set_network_dns`). ADR 0194 marked; connectivity §2 amended. records/index/cycle pass.

jschoubben added 1 commit 2026-10-03 19:56:34 +00:00

ADR 0196: a node asks the mesh's resolver first, and a public one only when it is silent f5d518d256

ADR 0194 rejected sending every query to the mesh's resolver because a node with its tunnel down
would resolve nothing; a public resolver listed second answers exactly then. That drops the
systemd-resolved stub and the runtime's dns: containers copy the machine's resolvers. Narrows 0194;
amends connectivity §2.

jschoubben merged commit 50ddaf8408 into main

2026-10-03 20:01:06 +00:00

jschoubben deleted branch decision/0196-nodes-ask-the-mesh-resolver-with-a-public-fallback

2026-10-03 20:01:07 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/hq#330