beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(tailscale-router): stop dnsmasq from intercepting host DNS queries #79

Merged
beatzaplenty merged 1 commits from worktree-peaceful-stirring-noodle into main 2026-07-27 23:27:34 +00:00
Conversation 0 Commits 1 Files Changed 1
+8
beatzaplenty commented 2026-07-27 23:27:30 +00:00
Owner
Copy Link
Copy Source

NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds
127.0.0.1 to networking.nameservers and binds dnsmasq to listen-address=127.0.0.1.
This made the host route all its own DNS through dnsmasq, which had
no-resolv=true and no upstream for anything outside the tailnet domain —
so every non-tailscale DNS query from the host itself (including SSSD
resolving the IPA server FQDN after the IPA client module was added) failed.

Setting resolveLocalQueries=false limits dnsmasq to its intended role: a
forwarding proxy reachable on the LAN interface for IPA's conditional
forwarder. The host uses domainControllerIp directly (already set in
networking.nameservers in host.nix).

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds 127.0.0.1 to networking.nameservers and binds dnsmasq to listen-address=127.0.0.1. This made the host route all its own DNS through dnsmasq, which had no-resolv=true and no upstream for anything outside the tailnet domain — so every non-tailscale DNS query from the host itself (including SSSD resolving the IPA server FQDN after the IPA client module was added) failed. Setting resolveLocalQueries=false limits dnsmasq to its intended role: a forwarding proxy reachable on the LAN interface for IPA's conditional forwarder. The host uses domainControllerIp directly (already set in networking.nameservers in host.nix). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty added 1 commit 2026-07-27 23:27:31 +00:00
fix(tailscale-router): stop dnsmasq from intercepting host DNS queries
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m30s
Details
c7bbf88dce 
NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds
127.0.0.1 to networking.nameservers and binds dnsmasq to listen-address=127.0.0.1.
This made the host route all its own DNS through dnsmasq, which had
no-resolv=true and no upstream for anything outside the tailnet domain —
so every non-tailscale DNS query from the host itself (including SSSD
resolving the IPA server FQDN after the IPA client module was added) failed.

Setting resolveLocalQueries=false limits dnsmasq to its intended role: a
forwarding proxy reachable on the LAN interface for IPA's conditional
forwarder. The host uses domainControllerIp directly (already set in
networking.nameservers in host.nix).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplenty merged commit 543ea432f0 into main 2026-07-27 23:27:34 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
beatzaplenty
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#79