Kyle Isom
5d82e27ba4
All nodes now list 1.1.1.1 and 8.8.8.8 as fallback nameservers after MCNS. When MCNS is down, internal names (.svc.mcp.metacircular.net) fail but external DNS (google.com, github.com, etc.) keeps working. Lesson from 2026-04-03 incident: without fallbacks, MCNS failure caused total DNS blackout including external services, forcing Tailscale to be disabled to restore any DNS resolution. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
30 lines
887 B
Nix
30 lines
887 B
Nix
{ inputs, ... }:
|
|
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
./disk-config.nix
|
|
../../configs/mcpkg.nix
|
|
../../configs/mcp.nix
|
|
];
|
|
|
|
config = {
|
|
# FIDO2 LUKS unlock (matches vade setup)
|
|
boot.initrd.luks.devices."crypted".crypttabExtraOpts = [
|
|
"fido2-device=auto"
|
|
"token-timeout=10"
|
|
];
|
|
|
|
# Allow rootless containers (Podman) to bind port 53 for CoreDNS (MCNS precursor).
|
|
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53;
|
|
|
|
# Open ports: DNS (53), mc-proxy (443, 8443, 9443), exod (8080, 9090).
|
|
networking.firewall.allowedTCPPorts = [ 53 443 8443 9443 8080 9090 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
|
|
# DNS: MCNS for internal zones, public resolvers as fallback.
|
|
networking.nameservers = [ "192.168.88.181" "1.1.1.1" "8.8.8.8" ];
|
|
services.resolved.domains = [ "~mcp.metacircular.net" ];
|
|
};
|
|
}
|