Set a proper default value for services.resolved.fallbackDns

[sagehane]

Issue description

services.resolved.fallbackDns is empty as a default value, and has the description of:

A list of IPv4 and IPv6 addresses to use as the fallback DNS servers. If this option is empty, a compiled-in list of DNS servers is used instead.

The "compiled-in list" seems to be:

1.1.1.1 8.8.8.8 1.0.0.1 8.8.4.4
2606:4700:4700::1111 2001:4860:4860::8888
2606:4700:4700::1001 2001:4860:4860::8844

This means that if somebody wanted to intentionally set the list to an empty value, the person will need to try some workarounds.

Proposed solution

Just set the compiled value as the default value, and stop relying on the compiled-in list.

---

This affects 20.03, 20.09, and unstable versions of at least 21.05pre271444.9816b99e71c.

[stale]

I marked this as stale due to inactivity. → More info

[fightingdreamer]

services.resolved.fallbackDns set to empty value is not empty, it affects 21.05.

For me it's security issue, I don't want my server to contact public DNS without being explicitly allowed to do so.

[sagehane]

Relevant upstream issue: systemd/systemd#494.
Looks like they don't care to change it.

This value only seems to be used as a last resort when the config.networking.nameservers isn't set and "if none could be learnt via dhcp or ppp".

[solbu]

Relevant upstream issue: systemd/systemd#494. Looks like they don't care to change it.

Oh, he cares.
He cares so much and has a strong oppinion on how this should be done that he refuses to change it.

Don't mistake Poetterings answer for not caring. He cares deeply.

[benaryorg]

Note that overriding default values is indeed possible using a single foo= statement with no value. In fact this would be supported by the NixOS module if it weren't for the default being injected on an empty list.

This would be a breaking change for a select few I assume, but rewriting the type of services.resolved.fallbackDns to be types.nullOr (types.listOf types.str) and setting the default value to null and changing the optionalString logic to be != null then providing [] as a value (from a user perspective) would set the config value to FallbackDNS= which would override the upstream behaviour to use no fallback servers.

As a stopgap measure you can use this in your config, but being able to use this without extraConfig would be nice considering there is an actual option for this kind of thing.

services.resolved.extraConfig =
''
  FallbackDNS=
'';

Edit: gonna send a pull request