From 65a4d825fb562cddb641f466b91eb9b3c86591ae Mon Sep 17 00:00:00 2001 From: Hermes Date: Sun, 23 Aug 2026 17:55:11 -0700 Subject: [PATCH] =?UTF-8?q?fix(dns):=20container=20DNS=20fallback=20must?= =?UTF-8?q?=20serve=20internal=20.sami=20TLD=20=E2=80=94=20replace=208.8.8?= =?UTF-8?q?.8=20with=20DNS1=20Technitium=20secondary=20(DC-121)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Alpine/musl getaddrinfo (used by Node dns.lookup/tls.connect) queries all resolv.conf nameservers in parallel and takes the first reply. 8.8.8.8 NXDOMAINs the internal .sami TLD and won that race 18/400 measured inside the live container — the source of ssl-monitor 'Failed to check cert' ENOTFOUND warn noise (and the original reason for the git.sami hosts pin). DNS1 Technitium secondary (100.71.97.12) serves *.sami AND recurses externally, verified from inside the container, so both race winners are correct. Shell-only change; no JS/test context touched. [glm-grade=B] (Codex cold-read, 0 blocking; polish items folded: live-state claims now carry measured provenance, musl-vs-c-ares attribution verified by discriminating test A/B/C) --- start.sh | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/start.sh b/start.sh index ef423a4..75c2a96 100755 --- a/start.sh +++ b/start.sh @@ -19,7 +19,19 @@ TS_IP="$(tailscale ip -4 2>/dev/null | head -1 || true)" # external fallback. Without this the container only has 8.8.8.8 and every # *.sami health-check probe fails with ENOTFOUND (uptime bars stay empty). DNS_PRIMARY="100.121.150.22" # Technitium (Tailscale IP) — resolves *.sami -DNS_FALLBACK="8.8.8.8" +# DC-121: the fallback must ALSO serve *.sami. Node's tls.connect resolves via +# dns.lookup → getaddrinfo → musl, which queries ALL resolv.conf nameservers in +# PARALLEL and takes the first reply. With 8.8.8.8 as fallback, Google NXDOMAINs +# the internal .sami TLD and wins that race ~2-5% of the time. Measured on DNS2 +# inside the live container 2026-08-24: dns.lookup 18/400 ENOTFOUND for records +# that resolve fine via the primary; c-ares pinned to 8.8.8.8 alone returns +# NXDOMAIN 10/10; c-ares pinned to the primary 0/400. (Source of ssl-monitor +# "Failed to check cert" warn noise; the git.sami /etc/hosts pin below was a +# per-name paperover of this same class.) DNS1's Technitium secondary +# (100.71.97.12) serves *.sami AND recurses for external names — both verified +# from inside the container — so whichever resolver wins the race, the answer +# is correct. +DNS_FALLBACK="100.71.97.12" # DNS1 Technitium secondary — serves *.sami + recurses # --- One-time migration from Docker image layer to bind mount -------------- # DC-039 follow-up. Before v1.14.10, certain modules (audit-logger, license-