Jan Novak
6efa069b12
Document the psmf host (DNS, second tailscale netns instance, nginx vhosts, migration plan) and add the docker-dev-22 psmf-data-sync service plus the storage-23 pg_hba.conf entry it needs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
157 lines
3.6 KiB
Markdown
157 lines
3.6 KiB
Markdown
## disable systemd-resolved
|
|
|
|
```bash
|
|
sudo mkdir -p /etc/systemd/resolved.conf.d
|
|
sudo tee /etc/systemd/resolved.conf.d/disable-stub.conf <<EOF
|
|
[Resolve]
|
|
DNSStubListener=no
|
|
EOF
|
|
|
|
# Fix /etc/resolv.conf symlink so the box itself still resolves
|
|
sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
|
|
|
|
sudo systemctl restart systemd-resolved
|
|
```
|
|
|
|
|
|
## dnsmasq in ts2 namespace
|
|
|
|
```bash
|
|
sudo mkdir -p /etc/dnsmasq-ts2
|
|
sudo tee /etc/dnsmasq-ts2/dnsmasq.conf <<'EOF'
|
|
# Inside ts2 netns — tailscale0 is the only real interface.
|
|
# Bind to all (namespace is isolated, so this is safe).
|
|
no-resolv
|
|
no-hosts
|
|
|
|
# Upstreams (explicit, no /etc/resolv.conf dependency inside netns)
|
|
server=1.1.1.1
|
|
server=9.9.9.9
|
|
|
|
# Zone
|
|
local=/intranet/
|
|
domain=intranet
|
|
|
|
address=/psmf.intranet/100.90.25.77
|
|
address=/psmf-new.intranet/100.90.25.77
|
|
|
|
cache-size=1000
|
|
log-facility=/var/log/dnsmasq-ts2.log
|
|
|
|
user=dnsmasq
|
|
pid-file=/run/dnsmasq-ts2.pid
|
|
EOF
|
|
```
|
|
|
|
```bash
|
|
# systemd-unit
|
|
sudo tee /etc/systemd/system/dnsmasq-ts2.service <<'EOF'
|
|
[Unit]
|
|
Description=dnsmasq inside ts2 netns (intranet zone)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
# If you have a unit that sets up the ts2 namespace + tailscaled inside it,
|
|
# add it here, e.g.:
|
|
# Requires=tailscaled-ts2.service
|
|
# After=tailscaled-ts2.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
NetworkNamespacePath=/var/run/netns/ts2
|
|
ExecStartPre=/usr/sbin/dnsmasq --test -C /etc/dnsmasq-ts2/dnsmasq.conf
|
|
ExecStart=/usr/sbin/dnsmasq -k -C /etc/dnsmasq-ts2/dnsmasq.conf
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
```
|
|
|
|
```bash
|
|
# validate and start
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable --now dnsmasq-ts2
|
|
sudo systemctl status dnsmasq-ts2 --no-pager
|
|
|
|
|
|
sudo ip netns exec ts2 ss -lnup | grep :53
|
|
sudo ip netns exec ts2 dig @127.0.0.1 psmf.intranet +short
|
|
sudo ip netns exec ts2 dig @127.0.0.1 cloudflare.com +short
|
|
```
|
|
|
|
|
|
## dnsmasq in root namespace
|
|
|
|
```bash
|
|
sudo mkdir -p /etc/dnsmasq-root
|
|
sudo tee /etc/dnsmasq-root/dnsmasq.conf <<'EOF'
|
|
# Root netns instance. Stock dnsmasq.service must be disabled/masked
|
|
# so it doesn't fight us for port 53.
|
|
# systemd-resolved stub listener is disabled (see top of this file).
|
|
|
|
# Only listen on these — don't grab :53 on every interface.
|
|
bind-interfaces
|
|
interface=br0
|
|
interface=tailscale0
|
|
|
|
# Upstreams (explicit, no /etc/resolv.conf lookup)
|
|
no-resolv
|
|
no-hosts
|
|
server=1.1.1.1
|
|
server=9.9.9.9
|
|
|
|
# Zone
|
|
local=/intranet/
|
|
domain=intranet
|
|
|
|
address=/psmf.intranet/100.90.25.77
|
|
address=/psmf-new.intranet/100.90.25.77
|
|
|
|
cache-size=1000
|
|
log-facility=/var/log/dnsmasq-root.log
|
|
|
|
user=dnsmasq
|
|
pid-file=/run/dnsmasq-root.pid
|
|
EOF
|
|
```
|
|
|
|
```bash
|
|
# systemd-unit
|
|
sudo tee /etc/systemd/system/dnsmasq-root.service <<'EOF'
|
|
[Unit]
|
|
Description=dnsmasq in root netns (intranet zone)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
# Make sure the stock apt dnsmasq is out of the way:
|
|
# sudo systemctl disable --now dnsmasq
|
|
# sudo systemctl mask dnsmasq
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStartPre=/usr/sbin/dnsmasq --test -C /etc/dnsmasq-root/dnsmasq.conf
|
|
ExecStart=/usr/sbin/dnsmasq -k -C /etc/dnsmasq-root/dnsmasq.conf
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
```
|
|
|
|
```bash
|
|
# validate and start
|
|
sudo systemctl daemon-reload
|
|
sudo systemctl enable --now dnsmasq-root
|
|
sudo systemctl status dnsmasq-root --no-pager
|
|
|
|
# verify it's bound only on br0 + tailscale0 (not on lo, not 0.0.0.0)
|
|
sudo ss -lnup | grep :53
|
|
|
|
# smoke test against the host's own br0 / tailscale0 IP
|
|
BR0_IP=$(ip -4 -o addr show br0 | awk '{print $4}' | cut -d/ -f1)
|
|
TS0_IP=$(ip -4 -o addr show tailscale0 | awk '{print $4}' | cut -d/ -f1)
|
|
dig @"$BR0_IP" psmf.intranet +short
|
|
dig @"$TS0_IP" psmf.intranet +short
|
|
dig @"$BR0_IP" cloudflare.com +short
|
|
``` |