sami7777/dashcaddy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(dns): container DNS fallback must serve internal .sami TLD — replace 8.8.8.8 with DNS1 Technitium secondary (DC-121)
CI / Test & Lint (push) Canceled after 0s
Details
CI / Security audit (push) Canceled after 0s
Details

Browse Source 
Alpine/musl getaddrinfo (used by Node dns.lookup/tls.connect) queries all
resolv.conf nameservers in parallel and takes the first reply. 8.8.8.8
NXDOMAINs the internal .sami TLD and won that race 18/400 measured inside
the live container — the source of ssl-monitor 'Failed to check cert'
ENOTFOUND warn noise (and the original reason for the git.sami hosts pin).
DNS1 Technitium secondary (100.71.97.12) serves *.sami AND recurses
externally, verified from inside the container, so both race winners are
correct. Shell-only change; no JS/test context touched.

[glm-grade=B] (Codex cold-read, 0 blocking; polish items folded: live-state
claims now carry measured provenance, musl-vs-c-ares attribution verified
by discriminating test A/B/C)
This commit is contained in:
Hermes
2026-08-23 17:55:11 -07:00
parent 46b6952c36
commit 65a4d825fb
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
start.sh
+13 -1
View File
@@ -19,7 +19,19 @@ TS_IP="$(tailscale ip -4 2>/dev/null | head -1 || true)"
# external fallback. Without this the container only has 8.8.8.8 and every
# *.sami health-check probe fails with ENOTFOUND (uptime bars stay empty).
DNS_PRIMARY="100.121.150.22" # Technitium (Tailscale IP) — resolves *.sami
DNS_FALLBACK="8.8.8.8"
# DC-121: the fallback must ALSO serve *.sami. Node's tls.connect resolves via
# dns.lookup → getaddrinfo → musl, which queries ALL resolv.conf nameservers in
# PARALLEL and takes the first reply. With 8.8.8.8 as fallback, Google NXDOMAINs
# the internal .sami TLD and wins that race ~2-5% of the time. Measured on DNS2
# inside the live container 2026-08-24: dns.lookup 18/400 ENOTFOUND for records
# that resolve fine via the primary; c-ares pinned to 8.8.8.8 alone returns
# NXDOMAIN 10/10; c-ares pinned to the primary 0/400. (Source of ssl-monitor
# "Failed to check cert" warn noise; the git.sami /etc/hosts pin below was a
# per-name paperover of this same class.) DNS1's Technitium secondary
# (100.71.97.12) serves *.sami AND recurses for external names — both verified
# from inside the container — so whichever resolver wins the race, the answer
# is correct.
DNS_FALLBACK="100.71.97.12" # DNS1 Technitium secondary — serves *.sami + recurses
# --- One-time migration from Docker image layer to bind mount --------------
# DC-039 follow-up. Before v1.14.10, certain modules (audit-logger, license-