From 31235650111542cf17e18169af050f8a16c01f19 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 27 Jul 2026 19:23:46 +1000 Subject: [PATCH] fix(tailscale-router): scope ts.net forwarder to tailnet subdomain IPA refuses to create a forward zone for ts.net because it's a real public TLD with DNSimple nameservers. The forward zone must use the tailnet-specific subdomain (vars.tailnetDomain, e.g. tail13f623.ts.net) instead. Update dnsmasq server selector and comments to match. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01ULXzafSDwGhmFGnn3LtDSQ --- modules/tailscale/ts-dns-forwarder.nix | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/modules/tailscale/ts-dns-forwarder.nix b/modules/tailscale/ts-dns-forwarder.nix index 370c31b..1745177 100644 --- a/modules/tailscale/ts-dns-forwarder.nix +++ b/modules/tailscale/ts-dns-forwarder.nix @@ -12,9 +12,11 @@ # # Configure FreeIPA once after deploying this host: # kinit admin - # ipa dnsforwardzone-add ts.net \ + # ipa dnsforwardzone-add ${vars.tailnetDomain} \ # --forwarder=${vars.tailscaleRouterIp} \ # --forward-policy=only + # Note: IPA refuses to shadow ts.net (a real public TLD); use the + # tailnet-specific subdomain (vars.tailnetDomain) instead. services.dnsmasq = { enable = true; settings = { @@ -33,10 +35,15 @@ no-resolv = true; # Tailscale's internal "Quad100" resolver — reachable from any - # Tailscale node via the tailscale0 interface. All *.ts.net queries - # (MagicDNS hostnames like raspberrypi.tail13f623.ts.net) are - # forwarded here exclusively. - server = [ "/ts.net/100.100.100.100" ]; + # Tailscale node via the tailscale0 interface. Scoped to the + # specific tailnet subdomain (vars.tailnetDomain) rather than + # all of ts.net: FreeIPA refuses to shadow ts.net (a real public + # TLD with DNSimple nameservers) so the conditional forward zone + # in FreeIPA must use the tailnet-specific subdomain instead: + # ipa dnsforwardzone-add ${vars.tailnetDomain} \ + # --forwarder=${vars.tailscaleRouterIp} \ + # --forward-policy=only + server = [ "/${vars.tailnetDomain}/100.100.100.100" ]; }; };