dns: enable Moshpit names on the machine, on any OS

[ralyodio]

moshcode dns could print a systemd-resolved config and run a resolver in the foreground. Everything between those two — applying the routing, keeping the bridge alive, saying whether it worked — was left to the reader, and only Linux was covered.

moshcode dns enable      run the bridge and route Moshpit TLDs to it
moshcode dns disable     stop it and remove the routing
moshcode dns status      what is running, what is routed, does it work

This makes Moshpit resolution work for curl, any browser, any app — not just TronBrowser.

One suffix, not the whole resolver

Each OS gets the mechanism that routes a single suffix rather than the one that replaces the machine's nameserver:

macOS	/etc/resolver/<tld>, read per query — nothing to restart
Linux	systemd-resolved Domains=~tld routing-only domains, or dnsmasq
Windows	one NRPT rule per namespace

That choice is the whole safety story. Becoming the machine's nameserver would put every lookup on the box behind this bridge; routing only the Moshpit TLDs means the worst failure is that Moshpit names stop working.

Windows can't express a port

NRPT rules have nowhere to put one, so the bridge must be on 53 there. Refused at plan time with the reason — the runtime symptom would be a rule that looks correct pointing at a port nothing listens on.

Plans are data

--dry-run prints the exact file contents and commands before anything runs. This edits system DNS under sudo, so being inspectable first is the point. It also means every platform's behaviour is testable from any platform — the only way the Windows and macOS paths get exercised at all.

Two states called out rather than discovered

• Routing up, bridge down → every Moshpit name fails instead of falling through. status says so loudly.
• Routing is a snapshot. Arbitrary endings share no suffix, so all ~200 claimed TLDs are enumerated; one claimed later won't resolve until enable is re-run. status compares the counts and reports drift.

Known limitation

Not yet a systemd unit / launchd job / Windows service, so the bridge doesn't survive a reboot. Stated in the enable output rather than discovered when names stop resolving. Natural follow-up.

Tests

13 new, 43 across the dns suites. Full-suite run exceeds 2 minutes locally (pre-existing slow tests), so it's running separately — I'll report if anything else breaks.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.