This is required in the case one uses nsd as a primary name server.
Otherwise, the nsd instance cannot notify the secondary name servers
properly, as the network may still be unreachable by that point.
networkd-dispatcher is driven by systemd-networkd events, so enabling
the module without `networking.useNetworkd = true` leaves configured
scripts unrun with no indication of why. Warn at evaluation time to make
the misconfiguration obvious. (See #538523)
This adds support for services.unbound.resolveLocalQueries with
systemd-resolved by improving the general behavior similar to the
dnsmasq module.
With this change, it not only adjusts resolvconf (which is not used when
systemd-resolved is used) but also prepends the loopback addresses to
networking.nameservers.
The module bind-mounted the LoadCredential-provided key onto a
/private-key target at the filesystem. systemd must create that target
inode before overlaying the credential; the mount lives in the unit's
namespace but the inode write hits the host filesystem, so a 0-byte
/private-key file leaks onto the host and persists after the unit stops.
Point PrivateKeyPath directly at the credential
(/run/credentials/yggdrasil.service/private-key) and drop
BindReadOnlyPaths. The DynamicUser can read the credentials dir, so the
bind was never needed.
Resolves#531972
Assisted-by: Oh My Pi (claude-opus-4-8)
The preStart chowned `hosts/` and `invitations/` to `tinc-<network>`
but left `/etc/tinc/<network>/` itself owned by root (or a stale UID
after a `tinc-<network>` UID reassignment). Fine while tinc 1.0 only
read config there, but tinc 1.1+ and tincr write a per-peer address
bootstrap cache into the network directory, so the daemon needs to
write it. When it can't, the save fails (tincr logs "Permission
denied", tinc 1.1pre18 swallows it), the cache stays empty and
reconnects fall back to DNS instead of the last-known IP.
Chown the network directory alongside hosts/ and invitations/. Use a
single `install -d` so existing directories with a stale owner get
fixed too, which plain `mkdir -p` would skip.
Assisted-by: Claude Code (claude-opus-4-7)
Previously, enabling nssmdns would enable the full mdns module by
default, as well as the minimal one. Unfortunately, the full mdns module
introduces a 5 second delay whenever it fails to perform a reverse
hostname lookup (`gethostbyaddr`).
For example, this adds a 5 second delay to ping as follows:
1. Ping resolves the hostname (example.com) to an IP address. This query
is serviced by the user's DNS resolver, so it returns quickly.
2. Ping attempts to resolve the IP address back into a hostname via
`gethostbyaddr`.
3. If the upstream DNS server fails to resolve the IP address back into
a hostname (many domain-names lack reverse DNS records), NSS falls
back on querying via Avahi (via the `mdns` module).
4. mDNS is a broadcast protocol, so Avahi has to wait the full 5 second
timeout before it can return a failure.
This patch fixes this by disabling the full `mdns` NSS module unless the
new disabled-by-default `nssmdnsFull` option is enabled. The
still-enabled `mdns_minimal` module only performs reverse IP lookups for
`169.254.0.0/16` (link-local IP addresses) so this 5 second delay will
only apply to link-local pings by domain-name.
In practice, this change shouldn't negatively affect the vast majority
of users. The only affected users are those who:
1. Are relying on Avahi to resolve IP addresses into hostnames on their
local network via `gethostbyaddr`.
2. Are using mDNS hostnames that don't end in `.local`.
The minimal module is sufficient for, e.g., users who just want to
resolve hostnames for local printers and network shares.
Note: This patch not fix this by adding [!UNAVAIL=return] after `dns` as
discussed in (#291108) as that would treat mDNS as a fallback for DNS when
DNS is unavailable which, IMO, is incorrect. Whether or not we use mDNS
shouldn't depend on whether or not our DNS server is available.
fixes#291108
The PRs https://github.com/NixOS/nixpkgs/pull/496370 and
https://github.com/NixOS/nixpkgs/pull/499273 updated the netbird-ui
icon location in and removed Exec path from the netbird-ui wrapper,
respectively. However, this resulted in a bug where the both the Icon
and Exec paths pointed to non-existent files.
To address the regression, this PR adjusts the desktop file for the
netbird-ui wrapper to use the correct paths.
