From bf84245d4ba45605060e0f8a21f665229550b98c Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 7 Sep 2026 21:03:00 +0000 Subject: [PATCH] cc-ci host: one resolver set (no Hetzner caches), pin the host's own names MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit During the DNS cutover the Hetzner resolvers nixos-infect had left in networking.nix still served the old address (3h TTL) while 1.1.1.1/8.8.8.8 had the new one, so every other lookup of drone.ci.commoninternet.net from the box itself went to the old server: runner "cannot request stage 404", bridge "drone trigger failed 404", traefik probes alternating 200/404. Drop those resolvers; pin ci/drone/report/traefik/warm-keycloak/oc names to this host in networking.hosts. README §7 records it. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz --- README.md | 6 +++++- nix/hosts/cc-ci/configuration.nix | 11 +++++++++++ nix/hosts/cc-ci/networking.nix | 10 ++++++---- 3 files changed, 22 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index fe4945c..a11033e 100644 --- a/README.md +++ b/README.md @@ -301,7 +301,11 @@ stopped on the new host while its directory is copied: 1. **DNS** (operator, Gandi zone `commoninternet.net`): A records `ci`, `*.ci` and `ns-acme` → the new IPv4. `acme NS ns-acme` and `_acme-challenge.ci CNAME .acme…` stay as they - are. Wait for propagation (`dig +short ci.commoninternet.net`). + are. Wait for propagation (`dig +short ci.commoninternet.net`) — the records carry a 3 h TTL, + and resolvers that cached the old answer (the Hetzner ones in particular) keep serving it that + long. The new host must not list such a resolver: with a mixed set, every other lookup of its + own names went to the old server on 2026-09-07 (runner/bridge 404s). `networking.nix` drops + the Hetzner resolvers and `configuration.nix` pins the host's own names. 2. Check the new host answers on the new IP before DNS moves: `dig @ ns-acme.commoninternet.net` (acme-dns), `curl --resolve ci.commoninternet.net:443: https://ci.commoninternet.net/` (dashboard, valid cert), same for `report.ci` and `drone.ci`. diff --git a/nix/hosts/cc-ci/configuration.nix b/nix/hosts/cc-ci/configuration.nix index 1f4ef94..5ae76b9 100644 --- a/nix/hosts/cc-ci/configuration.nix +++ b/nix/hosts/cc-ci/configuration.nix @@ -79,6 +79,17 @@ }; networking.nameservers = [ "1.1.1.1" "8.8.8.8" ]; + # This host's own public names resolve to itself regardless of external DNS state (host + # processes: the drone runner, the harness, the orchestrator; containers use the resolvers + # above). Per-run recipe domains are random and cannot be pinned — those follow public DNS. + networking.hosts."195.201.88.249" = [ + "ci.commoninternet.net" + "drone.ci.commoninternet.net" + "report.ci.commoninternet.net" + "traefik.ci.commoninternet.net" + "warm-keycloak.ci.commoninternet.net" + "oc.ci.commoninternet.net" + ]; # ---- memory: 8 GB RAM shared by the swarm (recipe deploys) and 3–6 agent sessions --------- swapDevices = [ { device = "/swapfile"; size = 8192; } ]; diff --git a/nix/hosts/cc-ci/networking.nix b/nix/hosts/cc-ci/networking.nix index d3aa712..8fd73b6 100644 --- a/nix/hosts/cc-ci/networking.nix +++ b/nix/hosts/cc-ci/networking.nix @@ -5,10 +5,12 @@ # This file was populated at runtime with the networking # details gathered from the active system. networking = { - nameservers = [ "2a01:4ff:ff00::add:2" - "2a01:4ff:ff00::add:1" - "185.12.64.2" - ]; + # The Hetzner resolvers nixos-infect wrote here are deliberately gone: configuration.nix sets + # 1.1.1.1/8.8.8.8. During the 2026-09-07 cutover the Hetzner caches kept the OLD address for + # the full 3h TTL while the public resolvers already had the new one, and every other lookup + # of drone.ci.commoninternet.net from this box went to the old server (404s in the runner and + # the bridge). One consistent resolver set, and the host's own names pinned in + # configuration.nix, keep the CI independent of that. defaultGateway = { address = "172.31.1.1"; interface = "eth0"; }; defaultGateway6 = { address = "fe80::1";