The mesh's one resolver, what every node asks, and a node's hosts file (hq ADR 0194, 0196, 0199) #69

2026-10-05T18:43:10Z

mesh-admin commented

2026-10-05 18:43:10 +00:00

Supersedes the unmerged feat/mesh-dns-resolver (d0b74f1), replayed on today's main.

dnsmasq claims the mesh seat mesh-dns-resolver; no hosts file, no conf-dir, no listen-addresses setting; no longer writes daemon.json.
resolv-conf: the mesh's resolver by address first, 1.1.1.1 second, timeout:1 attempts:1.
docker writes live-restore and reloads docker.service (issue 190: a module does not write another software's configuration).
hosts: new module, Go, claims node-hosts-file (entries/add/remove), loopback and the machine's own name.

Merge order and rollout: policies are record, so nothing moves at merge — but every node's plan is refused until seat mesh-dns-resolver --to novox/dnsmasq is run, so that runs immediately after merging. Then novox first, then each node by push, per ADR 0194's steps. mesh-controller fix/the-runtime-file-is-the-runtimes merges after this.

Tests: mesh-controller go test ./... against this branch passes; module check hosts ok; hosts go test 12 pass.

Supersedes the unmerged feat/mesh-dns-resolver (d0b74f1), replayed on today's main. - dnsmasq claims the mesh seat mesh-dns-resolver; no hosts file, no conf-dir, no listen-addresses setting; no longer writes daemon.json. - resolv-conf: the mesh's resolver by address first, 1.1.1.1 second, timeout:1 attempts:1. - docker writes live-restore and reloads docker.service (issue 190: a module does not write another software's configuration). - hosts: new module, Go, claims node-hosts-file (entries/add/remove), loopback and the machine's own name. **Merge order and rollout:** policies are `record`, so nothing moves at merge — but every node's plan is refused until `seat mesh-dns-resolver --to novox/dnsmasq` is run, so that runs immediately after merging. Then novox first, then each node by push, per ADR 0194's steps. mesh-controller fix/the-runtime-file-is-the-runtimes merges after this. Tests: mesh-controller `go test ./...` against this branch passes; `module check` hosts ok; hosts `go test` 12 pass.

mesh-admin added 3 commits 2026-10-05 18:43:10 +00:00

The mesh's one resolver, what every node asks, and a node's hosts file (hq ADR 0194, 0196, 0199) 69d6b9066f

- dnsmasq holds mesh-dns-resolver: provides wildcard-resolution mesh-wide, forwards every declared
  zone (zones fact), listens on the private address and loopback only, reads no hosts file and no
  operator's files, and no longer writes the container runtime's dns.
- resolv-conf names the mesh's resolver by address, then 1.1.1.1, timeout 1, one attempt; it now
  holds the runtime's live-restore, which dnsmasq held and every node needs.
- resolved-split-dns routes the suffix to the mesh's resolver by address, not 127.0.0.1.
- hosts: new module holding node-hosts-file — the machine's own lines in its block of /etc/hosts,
  the operator's lines kept, changed by entries/add/remove through sudo -n.

The runtime's file is written by the runtime's module, not by what decides how a machine resolves (issue 190) f20c4b749b

resolv-conf would have taken over dnsmasq's write into daemon.json — the same defect issue 190
names. docker, on every machine, now writes live-restore and reloads its own service. Log rotation
is left as each machine has it.

hosts in Go, with the machine's own name in its block (ADR 0199) 076455ec78

The tools were TypeScript; the mesh's modules are Go. The write to /etc/hosts is now staged and
moved into place rather than written over the live file.

mesh-admin merged commit 76707bbe0e into main

2026-10-05 18:44:15 +00:00

mesh-admin deleted branch feat/the-mesh-has-one-resolver

2026-10-05 18:44:15 +00:00

mesh-admin commented

2026-10-06 23:08:46 +00:00

Delivery novox/mesh-catalog@76707bbe0e0b — held since 2026-10-06T23:05:28Z

Held for a person: merged without a passing check: only a person decides that it goes on — mesh-delivery.release with why lets it go on.

Delivery plan — builds dnsmasq, docker, new: modules/hosts, modules/resolv-conf, modules/resolved-split-dns → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person

tier 0: dnsmasq, docker
ace: receives docker; waits for a person: dnsmasq
g14: receives docker
novox: receives docker; waits for a person: dnsmasq
shanks: receives docker
dnsmasq waits for a person: its policy records (module)
dnsmasq provides wildcard-resolution: its consumers are sent again after it

Transitions

2026-10-06 23:05 (new) → proposed (announced): novox/mesh-catalog#69 merged; its head was not heard by this owner, so it is made from the forge's word
2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on

The commit's note under refs/notes/mesh-plan keeps every transition: git log --notes=mesh-plan.

**Delivery** `novox/mesh-catalog@76707bbe0e0b` — **held** since 2026-10-06T23:05:28Z Held for a person: merged without a passing check: only a person decides that it goes on — `mesh-delivery.release` with why lets it go on. **Delivery plan** — builds dnsmasq, docker, new: modules/hosts, modules/resolv-conf, modules/resolved-split-dns → ace, g14, novox, shanks; no bus step; 2 wait(s) for a person - tier 0: dnsmasq, docker - ace: receives docker; waits for a person: dnsmasq - g14: receives docker - novox: receives docker; waits for a person: dnsmasq - shanks: receives docker - dnsmasq waits for a person: its policy records (module) - dnsmasq provides wildcard-resolution: its consumers are sent again after it **Transitions** - 2026-10-06 23:05 (new) → proposed (announced): novox/mesh-catalog#69 merged; its head was not heard by this owner, so it is made from the forge's word - 2026-10-06 23:05 proposed → held (merged-unchecked): merged without a passing check — a verdict known with it is taken first: only a person decides that it goes on The commit's note under `refs/notes/mesh-plan` keeps every transition: `git log --notes=mesh-plan`.

jschoubben referenced this issue from a commit

2026-10-22 18:45:19 +00:00

Pin every R4e member module to mesh-sdk's final R4e head 875c680d, which holds main's #68 and #69, so the group pins one SDK

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: novox/mesh-catalog#69