Kyle Isom
5d82e27ba4
All nodes now list 1.1.1.1 and 8.8.8.8 as fallback nameservers after MCNS. When MCNS is down, internal names (.svc.mcp.metacircular.net) fail but external DNS (google.com, github.com, etc.) keeps working. Lesson from 2026-04-03 incident: without fallbacks, MCNS failure caused total DNS blackout including external services, forcing Tailscale to be disabled to restore any DNS resolution. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
26 lines
850 B
Nix
26 lines
850 B
Nix
{ inputs, pkgs, ... }:
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
# orion started as a desktop with an interactive installer;
|
|
# the disk is already provisioned.
|
|
# ./disk-config.nix
|
|
../../configs/mcpkg.nix
|
|
../../configs/mcp.nix
|
|
];
|
|
|
|
config = {
|
|
# Allow rootless containers (Podman) to bind port 53 for CoreDNS (MCNS precursor).
|
|
boot.kernel.sysctl."net.ipv4.ip_unprivileged_port_start" = 53;
|
|
|
|
# Open ports: DNS (53), mc-proxy (443, 8443, 9443), exod (8080, 9090).
|
|
networking.firewall.allowedTCPPorts = [ 53 443 8443 9443 8080 9090 ];
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
|
|
# DNS: MCNS for internal zones, public resolvers as fallback.
|
|
networking.nameservers = [ "192.168.88.181" "100.95.252.120" "1.1.1.1" "8.8.8.8" ];
|
|
services.resolved.domains = [ "~mcp.metacircular.net" ];
|
|
};
|
|
|
|
}
|