jschoubben
67d8d0dcbd
The review found broker own-secret paths drifting: mostly /var/lib/<module>/ broker, but grafana/redis/icecast/nextcloud carried a '-module' suffix to dodge a collision with the service's own /var/lib/<name> data, and photos sat under /etc. Normalized to one collision-free namespace a service never owns: /var/lib/mesh/<module>/broker, with a mesh-state directory resource for the parent, across 24 modules. audit-logger is grandfathered (lab-proven, referenced by the assigned test, and it has no service to collide with). All 33 manifests parse; no client hardcoded a path, so nothing in code moved. Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
64 lines
3.6 KiB
JSON
64 lines
3.6 KiB
JSON
{
|
|
"module": "dnsmasq",
|
|
"version": "1",
|
|
"requires": [
|
|
"resolver-data"
|
|
],
|
|
"provides": [
|
|
"wildcard-resolution"
|
|
],
|
|
"emits": [
|
|
"module.dnsmasq.name.added",
|
|
"module.dnsmasq.name.removed"
|
|
],
|
|
"own-secrets": {
|
|
"broker": "/var/lib/mesh/dnsmasq/broker"
|
|
},
|
|
"claims": [
|
|
{
|
|
"name": "the-dns-port",
|
|
"scope": "node"
|
|
}
|
|
],
|
|
"listens": [
|
|
{
|
|
"port": 53,
|
|
"protocol": "udp",
|
|
"from": "mesh",
|
|
"why": "names under every machine in this mesh, for this machine and what it runs",
|
|
"fixed": true
|
|
}
|
|
],
|
|
"resources": [
|
|
{
|
|
"id": "mesh-state",
|
|
"type": "directory",
|
|
"path": "/var/lib/mesh/dnsmasq",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "package",
|
|
"type": "package",
|
|
"package": "dnsmasq"
|
|
},
|
|
{
|
|
"id": "config",
|
|
"type": "file",
|
|
"path": "/etc/dnsmasq.conf",
|
|
"mode": "0644",
|
|
"content": "# Managed by the mesh. dnsmasq's own defaults are replaced whole rather than\n# patched, because this module owns the file and a patch would leave whatever\n# was there before to be discovered later.\n\n# What the mesh computed: one wildcard per machine, its name and everything\n# under it. Rewritten whenever a machine joins or leaves, which is why the\n# service below reflects it.\nconf-file=/etc/mesh-resolver/nodes.conf\n\n# Where it answers. Both are names the mesh chose, so this file needs to know\n# nothing about this particular machine:\n#\n# mesh0 the private network, so anything on it \u2014 including a container\n# on this machine \u2014 can ask.\n# 127.0.0.55 this machine's own use, for whatever points resolution at the\n# mesh. Not .53 or .54: systemd-resolved holds BOTH \u2014 .53 is its\n# stub and .54 its proxy stub \u2014 which this module asserted was\n# free until a machine said otherwise.\n#\n# Listening on a loopback address makes dnsmasq take the rest of\n# loopback with it, 127.0.0.1 included. That is why this module\n# claims `the-dns-port`: it takes the machine's DNS port, and\n# saying it takes only one address would be the same kind of\n# comfortable claim that .54 was free.\n#\n# .55 is a convention and not a reservation. If a future systemd\n# takes it, this line changes and nothing else does, which is the\n# reason it is written once here rather than in each module that\n# points at it.\n#\n# bind-dynamic rather than bind-interfaces: mesh0 does not exist until the\n# machine is on the private network, and binding an interface that is not there\n# yet fails to start rather than waiting for it.\nbind-dynamic\ninterface=mesh0\nlisten-address=127.0.0.55\n\n# **It forwards nothing, and must not read resolv.conf to find out where to.**\n# Whatever points this machine at the mesh writes its own address into\n# resolv.conf \u2014 so a resolver that read it for upstreams would find itself,\n# and every query it could not answer locally would loop until its receive\n# queue filled. That is not theoretical: it filled with 15KB of queries and\n# every lookup on the machine hung.\n#\n# It needs no upstream because it is never asked for anything else: the\n# asking module routes only the mesh's suffix here and leaves the rest\n# wherever the machine already sent it.\nno-resolv\ndomain-needed\nbogus-priv\n"
|
|
},
|
|
{
|
|
"id": "service",
|
|
"type": "service",
|
|
"unit": "dnsmasq.service",
|
|
"state": "running",
|
|
"boot": "enabled",
|
|
"restart-on": [
|
|
"config",
|
|
"mesh-resolver.nodes"
|
|
]
|
|
}
|
|
]
|
|
}
|