chore(release): v0.16.1 - #202
Merged
Merged
Conversation
v0.16.0 shipped the catch-all routing machinery and wired none of it in, so upgrading to it changed nothing: `dns enable` still wrote every claimed ending onto one `Domains=` line, systemd-resolved still accepted about 1090 of them and dropped the rest without an error a caller could see, and `curl <name>` still could not resolve. The release notes said routing had stopped being a list. It had not. #200 wires it, and makes it conditional rather than assumed: the upstreams are read from /etc/resolv.conf before routing is switched, and catch-all is only written when there is somewhere to forward. With no upstreams the per-ending list stays, because pointing every lookup at a bridge that cannot forward takes the machine's DNS with it rather than just Moshpit names. #201 keeps the resolver up when its socket errors after bind. The list is also getting worse on its own: 4593 endings this morning, 4882 by the afternoon, against a resolver cap near 1090. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.16.0 didn't fix what its notes claimed. This releases the version that does.
Why v0.16.0 was a no-op
It shipped the catch-all generators, upstream parsing and the forwarding path — and wired none of them in.
dns enablestill calledresolvedConf(tlds).Confirmed on a live box after upgrading to v0.16.0:
Written 4,586 · accepted by the resolver 1,090. My error, and my release notes were wrong.
What's in this one
#200 wires it, and makes it conditional rather than assumed:
Domains=~.+ forwardingUpstreams are read from
/etc/resolv.confbefore routing is switched — afterwards it may point at the bridge, and the real servers are no longer discoverable. Loopback entries are dropped so it can't forward to itself. Neither branch can take the box off the internet.#201 keeps the resolver up when its socket errors after bind.
The list is degrading on its own
4,593 endings this morning · 4,882 by the afternoon · resolver cap ~1,090. Every claim makes the per-ending approach worse, which is why the fix isn't "raise the limit".
After merge
Until that exists,
install.shkeeps serving v0.16.0.🤖 Generated with Claude Code