Merge pull request 'dnsmasq: pass the DNSSEC bit down from the validating upstreams' (#179 ) from fix/resolver-passes-the-dnssec-bit into main

dnsmasq: pass the DNSSEC bit down from the validating upstreams
A program that checks its resolver validates — Mailu's admin does, at start — could not use the mesh's resolver, and the one it ships instead knows no mesh name (novox/hq issue 171). proxy-dnssec copies the AD bit from 1.1.1.1 and 8.8.8.8, both of which validate.
2026-09-30 13:17:38 +00:00 · 2026-09-30 15:17:34 +02:00 · 2026-09-30 13:13:29 +00:00 · 2026-09-30 15:13:25 +02:00
3 changed files with 4 additions and 7 deletions
@@ -120,7 +120,7 @@
      "port": 7080,
      "protocol": "tcp",
      "from": "mesh",
-      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here \u2014 everything else 301s to https and would loop a proxy"
+      "why": "the web front over http; only the ACME HTTP-01 passthrough is routed here — everything else 301s to https and would loop a proxy"
    },
    {
      "name": "web-tls",
@@ -315,10 +315,7 @@
        "${dir:data-data}:/data",
        "${dir:data-dkim}:/dkim"
      ],
-      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified",
-      "dns": [
-        "192.168.203.254"
-      ]
+      "secrets-in-environment": "mailu-admin honours SECRET_KEY_FILE, DB_PW_FILE and API_TOKEN_FILE (configuration.py) but INITIAL_ADMIN_PW is env-only (start.py); the remaining containers' need for SECRET_KEY is unverified"
    },
    {
      "id": "imap",
@@ -80,7 +80,7 @@
    {
      "id": "server",
      "type": "container",
-      "name": "postgres",
+      "name": "mesh-store",
      "image": "pgvector/pgvector@sha256:cf134a767f474095eeba57e0117be8e568e011a63f33fbf252f14c9b760f8e6f",
      "env": {
        "POSTGRES_PASSWORD_FILE": "/run/secrets/superuser",
Author	SHA1	Message	Date
jschoubben	a2b9a9a411	Merge pull request 'dnsmasq: pass the DNSSEC bit down from the validating upstreams' (#179 ) from fix/resolver-passes-the-dnssec-bit into main	2026-09-30 13:17:38 +00:00
jschoubben	9523105df4	dnsmasq: pass the DNSSEC bit down from the validating upstreams A program that checks its resolver validates — Mailu's admin does, at start — could not use the mesh's resolver, and the one it ships instead knows no mesh name (novox/hq issue 171). proxy-dnssec copies the AD bit from 1.1.1.1 and 8.8.8.8, both of which validate.	2026-09-30 15:17:34 +02:00
jschoubben	4449f44cf1	Merge pull request 'mailu: admin asks the machine's resolver, not Mailu's own' (#178 ) from fix/mailu-admin-asks-the-machines-resolver into main	2026-09-30 13:13:29 +00:00
jschoubben	47f6e7d78b	mailu: admin asks the machine's resolver, not Mailu's own admin is the one container here that reaches something by a mesh name: the database, bound in database.env. A mesh name is answered by the machine's resolver, which the runtime hands every container that does not name its own (novox/hq ADR 0148); Mailu's unbound knows no mesh name, and since the mesh stopped copying names into containers admin could not find its database. The others keep unbound — rspamd needs a validating resolver for DNSBL lookups and asks for no mesh name.	2026-09-30 15:13:25 +02:00