dnsmasq: pass the DNSSEC bit down from the validating upstreams

A program that checks its resolver validates — Mailu's admin does, at start — could not use the mesh's resolver, and the one it ships instead knows no mesh name (novox/hq issue 171). proxy-dnssec copies the AD bit from 1.1.1.1 and 8.8.8.8, both of which validate.
Merge pull request 'mailu: admin asks the machine's resolver, not Mailu's own' (#178 ) from fix/mailu-admin-asks-the-machines-resolver into main
2026-09-30 15:17:34 +02:00 · 2026-09-30 13:13:29 +00:00 · 2026-09-30 15:13:25 +02:00 · 2026-09-30 12:31:30 +00:00
2 changed files with 3 additions and 6 deletions
@@ -120,7 +120,7 @@
      "port": 7080,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here \u2014 everything else 301s to https and would loop a proxy"
+      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here — everything else 301s to https and would loop a proxy"
    },
    {
      "name": "web-tls",
@@ -315,10 +315,7 @@
        "${dir:data-data}:/data",
        "${dir:data-dkim}:/dkim"
      ],
-      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
+      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified"
      "dns": [
        "192.168.203.254"
      ]
    },
    {
      "id": "imap",
Author	SHA1	Message	Date
jschoubben	9523105df4	dnsmasq: pass the DNSSEC bit down from the validating upstreams A program that checks its resolver validates — Mailu's admin does, at start — could not use the mesh's resolver, and the one it ships instead knows no mesh name (novox/hq issue 171). proxy-dnssec copies the AD bit from 1.1.1.1 and 8.8.8.8, both of which validate.	2026-09-30 15:17:34 +02:00
jschoubben	4449f44cf1	Merge pull request 'mailu: admin asks the machine's resolver, not Mailu's own' (#178 ) from fix/mailu-admin-asks-the-machines-resolver into main	2026-09-30 13:13:29 +00:00
jschoubben	47f6e7d78b	mailu: admin asks the machine's resolver, not Mailu's own admin is the one container here that reaches something by a mesh name: the database, bound in database.env. A mesh name is answered by the machine's resolver, which the runtime hands every container that does not name its own (novox/hq ADR 0148); Mailu's unbound knows no mesh name, and since the mesh stopped copying names into containers admin could not find its database. The others keep unbound — rspamd needs a validating resolver for DNSBL lookups and asks for no mesh name.	2026-09-30 15:13:25 +02:00
jschoubben	7ab522ba31	Merge pull request 'dnsmasq: answer a container's query, which arrives on the runtime's bridge' (#176 ) from fix/110-the-resolver-answers-a-container into main	2026-09-30 12:31:30 +00:00