New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
systemd unit needs Wants and Before #14059
Comments
It's not as simple as that. In some cases rec is used as the system resolver by the machine it is running on, in other cases just a service by other machines. Both use-cases are valid and need different unit files. |
Sorry, I don't see the difference. By using |
You log lines do suggest your rec is (also?) use as a local resolver, so I'm officially confused now. I'll let somebody who has more knowledge wrt systemd answer this. |
Indeed I do, and so again, super important for rec to start before that target is reached. Here's a little more from systemd.special(7):
|
As @omoerbeek mentioned, it's not possible to provide a single service file that meets everyone's needs. At present, pdns-recursor has no mechanism to ignore DNSSEC time validity checks, and so if your clock is too far off, DNSSEC fails to validate for basic things like the root zone or the TLD zones, and you can't resolve any names. To avoid this, an
As time sync is critically important to DNSSEC, and it is varied whether pdns-recursor on the system is used as the system's recursor, it was decided to remove the If your system has a reliable RTC, or another mechanism to set a reasonably close to accurate time (within an hour, preferably better) during startup that doesn't rely on DNS, then you can utilize systemd's drop-in mechanism to change the dependencies of |
Thanks for this breakdown, and I see your points. Some interesting observations from me:
You'd assume that would mean "well, NTP will sort that", but it won't.
Based on the above, and your statement "within an hour, preferably better", perhaps Either way, I couldn't find a discussion around this in the doco. Considering the impact it just had on my boot (tunnels not coming up, time not coming up etc), perhaps it needs to be documented? |
Short description
Due to #13210, recursor starts after the
nss-lookup.target
, and this then breaks other things likentpd
and Wireguard, as is shown here:Environment
Steps to reproduce
Reproducible by having the above version installed.
Expected behaviour
Recursor should be
Before
nss-lookup.target
so that other units waiting on that target work.Actual behaviour
See above.
Other information
I believe the unit needs
After
,Wants
, andBefore
, as per Debian's unit file for ISC bind.I'm no expert on systemd unit dependency stuff, but I'm inclined to trust them.
See also this discussion that makes things clearer.
The text was updated successfully, but these errors were encountered: