dnsmasq: pass the DNSSEC bit down from the validating upstreams

A program that checks its resolver validates — Mailu's admin does, at start — could not use the mesh's resolver, and the one it ships instead knows no mesh name (novox/hq issue 171). proxy-dnssec copies the AD bit from 1.1.1.1 and 8.8.8.8, both of which validate.
Merge pull request 'mailu: admin asks the machine's resolver, not Mailu's own' (#178 ) from fix/mailu-admin-asks-the-machines-resolver into main
2026-09-30 15:17:34 +02:00 · 2026-09-30 13:13:29 +00:00 · 2026-09-30 15:13:25 +02:00 · 2026-09-30 12:31:30 +00:00 · 2026-09-30 14:31:26 +02:00 · 2026-09-30 12:22:10 +00:00
5 changed files with 37 additions and 118 deletions
@@ -120,7 +120,7 @@
      "port": 7080,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here \u2014 everything else 301s to https and would loop a proxy"
+      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here — everything else 301s to https and would loop a proxy"
    },
    {
      "name": "web-tls",
@@ -315,10 +315,7 @@
        "${dir:data-data}:/data",
        "${dir:data-dkim}:/dkim"
      ],
-      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
-      "dns": [
-        "192.168.203.254"
-      ]
+      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified"
    },
    {
      "id": "imap",
@@ -58,10 +58,8 @@ export class PlexClient {
  static fromEnv(env: NodeJS.ProcessEnv = process.env): PlexClient {
    const url = env.MESH_PLEX_URL ?? `http://127.0.0.1:${env.PLEX_PORT ?? "32400"}`;
    const dataDir = env.MESH_PLEX_DATA_DIR ?? "/var/lib/plex";
-    // The manifest sets neither MESH_PLEX_TOKEN_FILE nor MESH_PLEX_TOKEN: the server already keeps its
-    // token in Preferences.xml, read here through the manifest's read-only mount of the config dir.
-    // A token the mesh minted would be one plex.tv never issued, and preferring it would break every
-    // call, so the module declares no token secret. The file and env overrides stay for hand runs.
+    // The operator-provided token is an own-secret the mesh mounts at MESH_PLEX_TOKEN_FILE (delivered
+    // by `secret accept`); prefer it, fall back to a bare env var, then to discovery from the data dir.
    const token = readSecret(env.MESH_PLEX_TOKEN_FILE) ?? env.MESH_PLEX_TOKEN ?? PlexClient.detectToken(dataDir);
    if (!token) throw new Error("no Plex token — set MESH_PLEX_TOKEN or make the data dir readable");
    return new PlexClient(url, token);
@@ -1,18 +1,6 @@
 {
  "module": "plex",
  "version": "1",
-  "provides": [
-    {
-      "name": "plex-api",
-      "scope": "mesh"
-    }
-  ],
-  "serves": {
-    "plex-api": {
-      "scheme": "http",
-      "port": 32400
-    }
-  },
  "capabilities": [
    "container-runtime"
  ],
@@ -25,7 +13,8 @@
    "*.download.completed"
  ],
  "own-secrets": {
-    "broker": "/var/lib/mesh/plex/broker"
+    "broker": "/var/lib/mesh/plex/broker",
+    "token": "/var/lib/mesh/plex/token"
  },
  "listens": [
    {
@@ -33,35 +22,7 @@
      "port": 32400,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the server itself: the apps, streaming and the web player, direct and through its route"
-    },
-    {
-      "name": "gdm-1",
-      "port": 32410,
-      "protocol": "udp",
-      "from": "mesh",
-      "why": "G'Day Mate discovery: players on the same network find the server without signing in"
-    },
-    {
-      "name": "gdm-2",
-      "port": 32412,
-      "protocol": "udp",
-      "from": "mesh",
-      "why": "G'Day Mate discovery"
-    },
-    {
-      "name": "gdm-3",
-      "port": 32413,
-      "protocol": "udp",
-      "from": "mesh",
-      "why": "G'Day Mate discovery"
-    },
-    {
-      "name": "gdm-4",
-      "port": 32414,
-      "protocol": "udp",
-      "from": "mesh",
-      "why": "G'Day Mate discovery"
+      "why": "streaming and the app; reaching it from outside is a route grant later"
    }
  ],
  "accesses": [
@@ -84,18 +45,6 @@
    {
      "path": "/services/media/audiobooks",
      "mode": "read"
-    },
-    {
-      "path": "/services/media/sport-games",
-      "mode": "read"
-    },
-    {
-      "path": "/services/media/live-shows",
-      "mode": "read"
-    },
-    {
-      "path": "/services/media/formula-1",
-      "mode": "read"
    }
  ],
  "resources": [
@@ -105,63 +54,39 @@
      "path": "/var/lib/mesh/plex",
      "mode": "0700"
    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
    {
      "id": "config",
      "type": "directory",
-      "mode": "0755",
-      "owner": "1000:1000"
-    },
-    {
-      "id": "data",
-      "type": "directory",
-      "mode": "0755",
+      "path": "/services/plex/config",
+      "mode": "0700",
      "owner": "1000:1000"
    },
    {
      "id": "transcode",
      "type": "directory",
-      "mode": "0755",
+      "path": "/services/plex/transcode",
+      "mode": "0700",
      "owner": "1000:1000"
    },
-    {
-      "id": "server-env",
-      "type": "file",
-      "path": "${dir:state}/server.env",
-      "mode": "0600",
-      "content": "ADVERTISE_IP=https://${bound:route:name}/\n"
-    },
    {
      "id": "server",
      "type": "container",
      "name": "plex",
-      "image": "plexinc/pms-docker@sha256:e0ab27395614a8e1a4fdf84c6bc60ac664915cfdde70c52d030c7728a1c48e14",
+      "image": "plexinc/pms-docker@sha256:83a425ae9e133b1cb2cc3b809556e01c61cd8ff65c582e41b4374bc2210bac9e",
      "network": "host",
      "env": {
        "PLEX_UID": "1000",
        "PLEX_GID": "1000",
        "TZ": "Etc/UTC"
      },
-      "env-file": [
-        "${dir:state}/server.env"
-      ],
      "volumes": [
-        "${dir:config}:/config",
-        "${dir:data}:/data",
-        "${dir:transcode}:/transcode",
-        "/services/media/movies:/movies:ro",
-        "/services/media/series:/series:ro",
-        "/services/media/anime:/anime:ro",
-        "/services/media/music:/music:ro",
-        "/services/media/audiobooks:/audiobooks:ro",
-        "/services/media/sport-games:/sport-games:ro",
-        "/services/media/live-shows:/live-shows:ro",
-        "/services/media/formula-1:/formula-1:ro"
+        "/services/plex/config:/config",
+        "/services/plex/transcode:/transcode",
+        "/services/media/movies:/movies",
+        "/services/media/series:/series",
+        "/services/media/anime:/anime",
+        "/services/media/music:/music",
+        "/services/media/audiobooks:/audiobooks"
      ]
    },
    {
@@ -171,28 +96,18 @@
      "network": "host",
      "volumes": [
        "/var/lib/mesh/plex/broker:/run/secrets/broker:ro",
-        "${dir:config}:/var/lib/plex/config:ro"
+        "/var/lib/mesh/plex/token:/run/secrets/token:ro",
+        "/services/plex/config:/var/lib/plex/config:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_PLEX_URL": "http://127.0.0.1:${port:32400}",
+        "MESH_PLEX_URL": "http://127.0.0.1:32400",
+        "MESH_PLEX_TOKEN_FILE": "/run/secrets/token",
        "MESH_PLEX_DATA_DIR": "/var/lib/plex"
      },
      "artifact": "runtime"
    }
  ],
-  "requires": [
-    "route"
-  ],
-  "contributes": {
-    "route": {
-      "label": "plex",
-      "endpoint": "stream"
-    }
-  },
-  "binds": {
-    "route": "${dir:state}/route.json"
-  },
  "build": {
    "on": [
      {
@@ -105,7 +105,7 @@
        "/var/lib/postgres/superuser.secret:/run/secrets/superuser:ro"
      ],
      "env": {
-        "MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:5432/postgres?sslmode=disable",
+        "MESH_PROVISION_POSTGRES": "postgres://postgres@127.0.0.1:${port:5432}/postgres?sslmode=disable",
        "MESH_PROVISION_POSTGRES_PORT": "${seat:mesh-store:5432}",
        "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/superuser",
        "MESH_BROKER_FILE": "/run/secrets/broker",
Author	SHA1	Message	Date
jschoubben	9523105df4	dnsmasq: pass the DNSSEC bit down from the validating upstreams A program that checks its resolver validates — Mailu's admin does, at start — could not use the mesh's resolver, and the one it ships instead knows no mesh name (novox/hq issue 171). proxy-dnssec copies the AD bit from 1.1.1.1 and 8.8.8.8, both of which validate.	2026-09-30 15:17:34 +02:00
jschoubben	4449f44cf1	Merge pull request 'mailu: admin asks the machine's resolver, not Mailu's own' (#178 ) from fix/mailu-admin-asks-the-machines-resolver into main	2026-09-30 13:13:29 +00:00
jschoubben	47f6e7d78b	mailu: admin asks the machine's resolver, not Mailu's own admin is the one container here that reaches something by a mesh name: the database, bound in database.env. A mesh name is answered by the machine's resolver, which the runtime hands every container that does not name its own (novox/hq ADR 0148); Mailu's unbound knows no mesh name, and since the mesh stopped copying names into containers admin could not find its database. The others keep unbound — rspamd needs a validating resolver for DNSBL lookups and asks for no mesh name.	2026-09-30 15:13:25 +02:00
jschoubben	7ab522ba31	Merge pull request 'dnsmasq: answer a container's query, which arrives on the runtime's bridge' (#176 ) from fix/110-the-resolver-answers-a-container into main	2026-09-30 12:31:30 +00:00
jschoubben	204bfbbaf9	dnsmasq: answer a container's query, which arrives on the runtime's bridge dnsmasq admits a query by the interface it arrives on when told interface=, and by the address it is sent to when told listen-address=. A container's query is sent to the machine's private address but arrives on docker0, so interface=mesh0 dropped it silently on every machine (novox/hq issue 110). Name the address, not the interface.	2026-09-30 14:31:26 +02:00
jschoubben	e0c09f46b6	Merge pull request 'dnsmasq: the runtime is reloaded when its dns file changes, and may then be restarted safely' (#175 ) from fix/110-the-runtime-reads-its-dns into main	2026-09-30 12:22:10 +00:00
jschoubben	e0faf012be	dnsmasq: the runtime is reloaded when its dns file changes, and may then be restarted safely novox/hq 04-ISSUES/110. The module writes the runtime's `dns` key and deliberately ordered no restart, because a restart stops every container. It also ordered no reload, and the key holds only for containers created after the runtime next starts. On two of four machines the runtime predated the file — one since August — so every container there was handed a public resolver and no mesh name resolved, while everything read as fine. The third machine works only because its runtime happened to restart later. The file now also sets live-restore, which the runtime reads on a reload, and the module declares the runtime reloaded when the file changes (ADR 0102: reload, don't restart). A reload still does not make `dns` take effect; what it does is make the one restart that key needs keep every container running. That restart stays the operator's, once per machine, and is harmless from the second time on. The mesh restarts nothing here. Undeclared, the runtime's unit goes back to the state it was found in (ADR 0118).	2026-09-30 14:22:03 +02:00
mesh-admin	1b19c79d63	Merge pull request 'postgres: the provisioner dials the port the mesh gave the store' (#174 ) from fix/postgres-provisioner-dials-the-port-it-was-given into main	2026-09-30 12:06:25 +00:00
jschoubben	4ec2ae1f7f	postgres: the provisioner dials the port the mesh gave the store MESH_PROVISION_POSTGRES named 127.0.0.1:5432 literally; the seat twin (${seat:mesh-store:5432}) corrected it only on the machine holding the mesh-store seat. On any other machine — ace, where the module provides postgres-database without the seat — the twin is empty and the sidecar would have dialled whatever else holds 5432 (HAL's postgres). ${port:5432} is the machine port on every node; on novox the twin still says the same 6852, so nothing moves there.	2026-09-30 14:01:53 +02:00