jschoubben
c88be88ccf
mesh/delivery merged: source.main moved to novox/mesh-catalog@94805575379f
mesh/check checking c88be88ccf2f on 94805575379f
The two server lines were literals in the template, so changing an upstream needed a build. They are now the config keys upstream-resolver-first (1.1.1.1) and upstream-resolver-second (8.8.8.8), placed with ${config:...}; the service already restarts on its config file. no-resolv and every other line stay.
Claude-Session: https://claude.ai/code/session_01NcbgfFfQ4Z9UE5jK32PmE5
88 lines
5.1 KiB
Plaintext
88 lines
5.1 KiB
Plaintext
# Managed by the mesh. dnsmasq's own defaults are replaced whole rather than
|
|
# patched, because this module owns the file and a patch would leave whatever
|
|
# was there before to be discovered later.
|
|
#
|
|
# This is one of the mesh's resolvers (novox/hq ADR 0194, 0223): it holds the
|
|
# `mesh-dns-resolver` seat, which more than one machine may hold, each answering
|
|
# the same names from the same roster. Every node and every container lists every
|
|
# holder and no public resolver, so whichever answers first gives the one answer.
|
|
# It holds the mesh's own names and nothing else (ADR 0191) — the roster is the
|
|
# mesh's, rendered into each holder; no other copy lives on any machine.
|
|
|
|
# What the mesh computed: one wildcard per machine — its name and everything
|
|
# under it — and the mesh's own suffix as a local domain, so a name under it is
|
|
# answered here or not at all and is never asked upstream. Rewritten whenever a
|
|
# machine joins or leaves, which is why the service below restarts on it: a
|
|
# reload makes dnsmasq re-read hosts files, not its configuration, and a
|
|
# wildcard is configuration.
|
|
conf-file=/etc/mesh-resolver/nodes.conf
|
|
|
|
# Every zone a module answers itself (ADR 0199): one forwarding line per zone, to
|
|
# the private address of the machine its module runs on and the port its
|
|
# answerer is published on. Nothing in a zone is answered here; what names a zone
|
|
# holds is the module's. Rewritten whenever a zone is declared or moves, and the
|
|
# service restarts on it for the same reason as above.
|
|
conf-file=/etc/mesh-resolver/zones.conf
|
|
|
|
# Where it answers: this machine's private address, so every node — and every
|
|
# container on every node, which copies its machine's resolvers — can ask; and
|
|
# loopback, for this machine's own use. Never a LAN address: a device that is
|
|
# not a member cannot reach what the mesh's names point at, and a LAN's resolver
|
|
# is its router's (ADR 0194).
|
|
#
|
|
# Named as an ADDRESS and not as the interface that carries it, on purpose. A
|
|
# container's query is addressed to this address but arrives on the runtime's
|
|
# bridge, and dnsmasq checks every query against what it was told to answer on:
|
|
# an `interface=` line admits queries by the interface they arrive on, a
|
|
# `listen-address=` line by the address they are sent to. With `interface=mesh0`
|
|
# alone, a query from a container was received and dropped without a word
|
|
# (novox/hq 04-ISSUES/110). The address admits it whatever bridge it comes in on.
|
|
#
|
|
# bind-interfaces, and never bind-dynamic (novox/hq issue 348). bind-dynamic
|
|
# re-reads the machine's addresses on every change of any link and closes each
|
|
# listener whose interface that reading did not find; a reading made while the
|
|
# container runtime deletes a bridge's virtual links fails ("index gone"), and
|
|
# then every listener is closed until a later change reads cleanly. On
|
|
# 2026-10-09 the private address was left unbound for twenty minutes, the daemon
|
|
# running and silent. bind-interfaces binds each address once, at start, and
|
|
# never closes it. It cannot bind an address that is not there yet, so the unit
|
|
# waits for it (the drop-in below); a new private address restarts the unit, as
|
|
# this file changing always did.
|
|
bind-interfaces
|
|
listen-address=${machine:address}
|
|
listen-address=127.0.0.1
|
|
|
|
# **It must never read resolv.conf to find out where to forward.** This
|
|
# machine's resolv.conf names this resolver — so a resolver that read it for
|
|
# upstreams would find itself, and every query it could not answer locally would
|
|
# loop until its receive queue filled. That is not theoretical: it filled with
|
|
# 15KB of queries and every lookup on the machine hung. no-resolv makes that loop
|
|
# impossible: the upstreams are the two lines below (the module's settings upstream-resolver-first and -second), and nothing on the machine
|
|
# can redirect them. The mesh's own names never reach them: the local= line in
|
|
# the file above stops them here, answered or refused.
|
|
no-resolv
|
|
server=${config:upstream-resolver-first}
|
|
server=${config:upstream-resolver-second}
|
|
|
|
# Both upstreams validate DNSSEC and say so with the Authenticated Data bit,
|
|
# and this passes that bit down rather than dropping it, which dnsmasq does
|
|
# unless told. It does not validate itself: an answer's trust is the upstream's
|
|
# and the path to it, which is what a forwarding resolver's trust always was.
|
|
# Without it a program that refuses to run behind a resolver that does not
|
|
# validate — a mail system's admin does exactly that check at start — cannot
|
|
# use this resolver (novox/hq 04-ISSUES/171).
|
|
proxy-dnssec
|
|
|
|
# A name without a dot is never forwarded, and reverse lookups of private ranges
|
|
# are answered here rather than asking the world who 10.x is.
|
|
domain-needed
|
|
bogus-priv
|
|
|
|
# **No hosts file, and no operator's files.** This machine's /etc/hosts is its
|
|
# own — the hosts module's block and the operator's lines (ADR 0199) — and the
|
|
# mesh's resolver answers every node, so a line written for one machine's own
|
|
# programs must not become an answer for all of them. Every per-node resolver
|
|
# went wrong exactly here: a hosts file read once at start, an operator's old
|
|
# line beside the mesh's, a drop-in read from a directory nobody owned.
|
|
no-hosts
|