The resolver declares both protocols it answers on

It declared udp/53 only. The daemon listens on tcp/53 as well, and a resolver is asked over tcp whenever an answer will not fit in a datagram — so on every converged machine that port is closed while the service reports itself healthy and the manifest reads as though the resolver were fully declared. The same fault as issue 136 in miniature: the declaration covers part of what the service does, and the gap is silent because nothing compares the two.
Merge pull request 'sshd: the daemon it owns starts at boot' (#136 ) from fix/sshd-declares-the-daemon-it-owns into main
2026-09-28 23:53:03 +02:00 · 2026-09-28 19:43:29 +00:00 · 2026-09-28 21:43:27 +02:00 · 2026-09-28 18:48:26 +00:00
2 changed files with 8 additions and 0 deletions
@@ -27,6 +27,13 @@
      "from": "mesh",
      "why": "every name for this machine and what it runs \u2014 the mesh's own answered here, the rest forwarded",
      "fixed": true
+    },
+    {
+      "port": 53,
+      "protocol": "tcp",
+      "from": "mesh",
+      "why": "the same names over tcp, which a resolver answers on as well and is asked for whenever an answer will not fit in a datagram. Declared because the daemon serves it: a declaration that covers one of the two protocols its own service listens on leaves the other closed while everything reports success",
+      "fixed": true
    }
  ],
  "resources": [
@@ -31,6 +31,7 @@
      "type": "service",
      "unit": "sshd.service",
      "state": "running",
+      "boot": "enabled",
      "restart-on": [
        "config"
      ]
Author	SHA1	Message	Date
jschoubben	acedc5d9d9	The resolver declares both protocols it answers on It declared udp/53 only. The daemon listens on tcp/53 as well, and a resolver is asked over tcp whenever an answer will not fit in a datagram — so on every converged machine that port is closed while the service reports itself healthy and the manifest reads as though the resolver were fully declared. The same fault as issue 136 in miniature: the declaration covers part of what the service does, and the gap is silent because nothing compares the two.	2026-09-28 23:53:03 +02:00
mesh-admin	521a8dd1e2	Merge pull request 'sshd: the daemon it owns starts at boot' (#136 ) from fix/sshd-declares-the-daemon-it-owns into main	2026-09-28 19:43:29 +00:00
jschoubben	e145e2236c	sshd: the daemon it owns starts at boot The module said the service must be running and nothing about boot, so the machine's own way back in was enabled only because something before the mesh had enabled it. All four machines happen to be enabled today; none of them is enabled because the mesh says so, and a machine adopted tomorrow would run ssh until its first reboot. Not `state: running` alone for the same reason the module exists: this is the one daemon whose absence cannot be fixed remotely.	2026-09-28 21:43:27 +02:00
mesh-admin	4d7e37e319	Merge pull request 'fail2ban bans through an action every machine has' (#135 ) from fix/fail2ban-bans-through-what-every-machine-has into main	2026-09-28 18:48:26 +00:00