recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cc-ci host: one resolver set (no Hetzner caches), pin the host's own names

Browse Source 
During the DNS cutover the Hetzner resolvers nixos-infect had left in
networking.nix still served the old address (3h TTL) while 1.1.1.1/8.8.8.8
had the new one, so every other lookup of drone.ci.commoninternet.net from
the box itself went to the old server: runner "cannot request stage 404",
bridge "drone trigger failed 404", traefik probes alternating 200/404.
Drop those resolvers; pin ci/drone/report/traefik/warm-keycloak/oc names to
this host in networking.hosts. README §7 records it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
This commit is contained in:
notplants
2026-09-07 21:03:00 +00:00
co-authored by Claude Fable 5.1
parent 72d4a31910
commit bf84245d4b
3 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nix/hosts/cc-ci/configuration.nix
+11
View File
@@ -79,6 +79,17 @@
};
networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
# This host's own public names resolve to itself regardless of external DNS state (host
# processes: the drone runner, the harness, the orchestrator; containers use the resolvers
# above). Per-run recipe domains are random and cannot be pinned — those follow public DNS.
networking.hosts."195.201.88.249" = [
"ci.commoninternet.net"
"drone.ci.commoninternet.net"
"report.ci.commoninternet.net"
"traefik.ci.commoninternet.net"
"warm-keycloak.ci.commoninternet.net"
"oc.ci.commoninternet.net"
];
# ---- memory: 8 GB RAM shared by the swarm (recipe deploys) and 3–6 agent sessions ---------
swapDevices = [ { device = "/swapfile"; size = 8192; } ];
nix/hosts/cc-ci/networking.nix
+6 -4
View File
@@ -5,10 +5,12 @@
# This file was populated at runtime with the networking
# details gathered from the active system.
networking = {
nameservers = [ "2a01:4ff:ff00::add:2"
"2a01:4ff:ff00::add:1"
"185.12.64.2"
];
# The Hetzner resolvers nixos-infect wrote here are deliberately gone: configuration.nix sets
# 1.1.1.1/8.8.8.8. During the 2026-09-07 cutover the Hetzner caches kept the OLD address for
# the full 3h TTL while the public resolvers already had the new one, and every other lookup
# of drone.ci.commoninternet.net from this box went to the old server (404s in the runner and
# the bridge). One consistent resolver set, and the host's own names pinned in
# configuration.nix, keep the CI independent of that.
defaultGateway = { address = "172.31.1.1"; interface = "eth0"; };
defaultGateway6 = {
address = "fe80::1";