From 36f5ebdf8602166ca1b95adc559ebc2031fd7bb5 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 27 Jul 2026 19:20:12 +1000 Subject: [PATCH 1/3] feat(tailscale-router): serve ts.net DNS forward zone for LAN hosts FreeIPA (the new authoritative DNS) cannot reach 100.100.100.100 (Tailscale's internal MagicDNS resolver) directly because the DC is not a Tailscale node. The tailscale-router IS a Tailscale node and can reach 100.100.100.100 via tailscale0, so it now runs a dnsmasq instance on its LAN interface that forwards all ts.net queries to Tailscale's resolver. After deploying this host, configure FreeIPA with: kinit admin ipa dnsforwardzone-add ts.net \ --forwarder=192.168.2.222 \ --forward-policy=only This replaces Pi-hole's conditional forwarder for ts.net and restores resolution of Tailscale MagicDNS names (e.g. raspberrypi.tail13f623.ts.net) for all LAN hosts using FreeIPA as their DNS server. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01ULXzafSDwGhmFGnn3LtDSQ --- modules/build-types/tailscale-router.nix | 1 + modules/tailscale/ts-dns-forwarder.nix | 45 ++++++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 modules/tailscale/ts-dns-forwarder.nix diff --git a/modules/build-types/tailscale-router.nix b/modules/build-types/tailscale-router.nix index bf3e1b2..557eef3 100644 --- a/modules/build-types/tailscale-router.nix +++ b/modules/build-types/tailscale-router.nix @@ -3,6 +3,7 @@ { imports = [ ../tailscale/subnet-router.nix + ../tailscale/ts-dns-forwarder.nix ../beszel/enable-agent.nix ]; diff --git a/modules/tailscale/ts-dns-forwarder.nix b/modules/tailscale/ts-dns-forwarder.nix new file mode 100644 index 0000000..370c31b --- /dev/null +++ b/modules/tailscale/ts-dns-forwarder.nix @@ -0,0 +1,45 @@ +{ vars, ... }: + +{ + # Run dnsmasq on the LAN interface as a forwarding-only resolver for + # *.ts.net (Tailscale MagicDNS names). FreeIPA's bind-dyndb-ldap + # cannot reach 100.100.100.100 (Tailscale's internal resolver) directly + # because the DC is not a Tailscale node. This host IS a Tailscale node + # and can reach 100.100.100.100 via its tailscale0 interface, so it + # acts as an intermediary: FreeIPA has a conditional forward zone for + # ts.net pointing here (vars.tailscaleRouterIp), and this dnsmasq + # instance forwards those queries onward to Tailscale's resolver. + # + # Configure FreeIPA once after deploying this host: + # kinit admin + # ipa dnsforwardzone-add ts.net \ + # --forwarder=${vars.tailscaleRouterIp} \ + # --forward-policy=only + services.dnsmasq = { + enable = true; + settings = { + # Listen only on the LAN interface — not tailscale0 or loopback. + # bind-interfaces prevents dnsmasq from binding to 0.0.0.0 and + # then filtering by interface later; combined with `interface` this + # ensures it genuinely listens only on eth0. + bind-interfaces = true; + interface = [ vars.lxcLanInterface ]; + + # Forward-only: no local /etc/hosts or /etc/resolv.conf reading, + # no negative caching of NXDOMAIN for names this instance doesn't + # serve. All ts.net queries come from FreeIPA's conditional forwarder + # and must be answered by Tailscale's resolver. + no-hosts = true; + no-resolv = true; + + # Tailscale's internal "Quad100" resolver — reachable from any + # Tailscale node via the tailscale0 interface. All *.ts.net queries + # (MagicDNS hostnames like raspberrypi.tail13f623.ts.net) are + # forwarded here exclusively. + server = [ "/ts.net/100.100.100.100" ]; + }; + }; + + networking.firewall.allowedUDPPorts = [ 53 ]; + networking.firewall.allowedTCPPorts = [ 53 ]; +} From 31235650111542cf17e18169af050f8a16c01f19 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 27 Jul 2026 19:23:46 +1000 Subject: [PATCH 2/3] fix(tailscale-router): scope ts.net forwarder to tailnet subdomain IPA refuses to create a forward zone for ts.net because it's a real public TLD with DNSimple nameservers. The forward zone must use the tailnet-specific subdomain (vars.tailnetDomain, e.g. tail13f623.ts.net) instead. Update dnsmasq server selector and comments to match. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01ULXzafSDwGhmFGnn3LtDSQ --- modules/tailscale/ts-dns-forwarder.nix | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/modules/tailscale/ts-dns-forwarder.nix b/modules/tailscale/ts-dns-forwarder.nix index 370c31b..1745177 100644 --- a/modules/tailscale/ts-dns-forwarder.nix +++ b/modules/tailscale/ts-dns-forwarder.nix @@ -12,9 +12,11 @@ # # Configure FreeIPA once after deploying this host: # kinit admin - # ipa dnsforwardzone-add ts.net \ + # ipa dnsforwardzone-add ${vars.tailnetDomain} \ # --forwarder=${vars.tailscaleRouterIp} \ # --forward-policy=only + # Note: IPA refuses to shadow ts.net (a real public TLD); use the + # tailnet-specific subdomain (vars.tailnetDomain) instead. services.dnsmasq = { enable = true; settings = { @@ -33,10 +35,15 @@ no-resolv = true; # Tailscale's internal "Quad100" resolver — reachable from any - # Tailscale node via the tailscale0 interface. All *.ts.net queries - # (MagicDNS hostnames like raspberrypi.tail13f623.ts.net) are - # forwarded here exclusively. - server = [ "/ts.net/100.100.100.100" ]; + # Tailscale node via the tailscale0 interface. Scoped to the + # specific tailnet subdomain (vars.tailnetDomain) rather than + # all of ts.net: FreeIPA refuses to shadow ts.net (a real public + # TLD with DNSimple nameservers) so the conditional forward zone + # in FreeIPA must use the tailnet-specific subdomain instead: + # ipa dnsforwardzone-add ${vars.tailnetDomain} \ + # --forwarder=${vars.tailscaleRouterIp} \ + # --forward-policy=only + server = [ "/${vars.tailnetDomain}/100.100.100.100" ]; }; }; From 7b4ce0ab3dc33dfd1d8720719ac9a05b046b308b Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 27 Jul 2026 21:52:39 +1000 Subject: [PATCH 3/3] fix(server): prevent zfs-init-tank from wiping pool on udev race zpool create -f was called if `zpool import -d /dev/disk/by-id` failed, which could happen due to a race with systemd-udev-settle. The disk would then be visible by the time zpool create ran, silently destroying all data on an otherwise-intact pool. Fix: locate the data disk first, retry the import directly against it as a fallback, then check zdb -l for existing ZFS label metadata before concluding the disk is blank. Remove -f so zpool create refuses rather than overwrites if a pool is present. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01ULXzafSDwGhmFGnn3LtDSQ --- modules/build-types/server.nix | 35 +++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/modules/build-types/server.nix b/modules/build-types/server.nix index 53bc190..5455065 100644 --- a/modules/build-types/server.nix +++ b/modules/build-types/server.nix @@ -44,14 +44,8 @@ in exit 0 fi - # Pool exists on a device but not yet imported — let the standard - # zfs-import-${poolName}.service handle it normally. - if zpool import -d /dev/disk/by-id -N "${poolName}" 2>/dev/null; then - exit 0 - fi - - # No pool found at all. Create it on the Proxmox data disk (scsi1), - # which appears as /dev/disk/by-id/scsi-*drive-scsi1 inside the VM. + # Locate the data disk first — used for both the fallback import + # attempt and, only if the disk is genuinely blank, pool creation. DATA_DISK="" for candidate in /dev/disk/by-id/scsi-*drive-scsi1; do [[ "$candidate" == *-part* ]] && continue @@ -63,8 +57,31 @@ in exit 1 fi + # Try importing via the by-id symlink directory first (normal path), + # then fall back to scanning the disk directly. The two-step exists + # because of a udev race: systemd-udev-settle.service can clear before + # /dev/disk/by-id/ entries are fully populated, causing the first + # import to fail even when the pool is intact on the disk. + if zpool import -d /dev/disk/by-id -N "${poolName}" 2>/dev/null; then + exit 0 + fi + if zpool import -d "$DATA_DISK" -N "${poolName}" 2>/dev/null; then + exit 0 + fi + + # Both import attempts failed. Before creating a new pool, verify the + # disk is genuinely blank — if ZFS label metadata is present the import + # failed for some other reason and we must not clobber existing data. + if zdb -l "$DATA_DISK" 2>/dev/null | grep -q "name: '${poolName}'"; then + echo "zfs-init-${poolName}: $DATA_DISK has ZFS pool '${poolName}' metadata but import failed — refusing to overwrite existing data. Run 'zpool import -d $DATA_DISK ${poolName}' manually to investigate." >&2 + exit 1 + fi + + # Disk is genuinely blank: create the pool. -f is intentionally + # omitted so that if we somehow reach this point with an existing pool + # on the disk, zpool refuses rather than silently destroying data. echo "zfs-init-${poolName}: creating pool on $DATA_DISK" - zpool create -f "${poolName}" "$DATA_DISK" + zpool create "${poolName}" "$DATA_DISK" ${lib.concatMapStrings (ds: '' zfs create "${poolName}/${ds}" '') poolDatasets}