Fix NFS mount device strings on lxc-docker: use FQDN, not search domain #25

2026-07-21T02:35:11Z

beatzaplenty commented

2026-07-21 02:35:11 +00:00

PR #23 got merged (d7aba85) before its follow-up correction commit (42da626) was pushed, so only the first, broken attempt landed on main -- confirmed live: the currently-deployed lxc-docker container (vmid 105) still has the old bare server:/tank/docker/config device string and the harmful global networking.search, and its NFS mounts are still failing exactly as before.

This PR lands the outstanding correction commit that never made it in:

Reverts networking.search = [ vars.homeDomain ]; -- confirmed live it backfires: it gives systemd-resolved a domain-matched but server-less global scope that gets prioritized over eth0's correctly-configured one for every *.sweet.home query, silently routing them to public fallback DNS (1.1.1.1 et al) instead of the LAN's real DNS server. resolvectl query --interface=eth0 server.sweet.home resolved correctly throughout, proving the LAN DNS server was never the actual problem.
Changes modules/docker/mount-data.nix to build each NFS device string from the FQDN (server.sweet.home) directly, sidestepping DNS search-domain behavior entirely -- matching the pattern modules/raspi/mount-data.nix already uses. Bare single-label names were never going to work anyway; systemd-resolved only tries LLMNR for those, never DNS search-suffixing.

Test plan

nixpkgs-fmt --check clean
statix clean
Full nix eval of every host/package succeeds
Operator: rebuild/redeploy lxc-docker, confirm the 5 NFS mounts come up this time

PR #23 got merged (d7aba85) before its follow-up correction commit (`42da626`) was pushed, so only the *first*, broken attempt landed on `main` -- confirmed live: the currently-deployed `lxc-docker` container (vmid 105) still has the old bare `server:/tank/docker/config` device string and the harmful global `networking.search`, and its NFS mounts are still failing exactly as before. This PR lands the outstanding correction commit that never made it in: - Reverts `networking.search = [ vars.homeDomain ];` -- confirmed live it backfires: it gives systemd-resolved a domain-matched but server-less *global* scope that gets prioritized over eth0's correctly-configured one for every `*.sweet.home` query, silently routing them to public fallback DNS (1.1.1.1 et al) instead of the LAN's real DNS server. `resolvectl query --interface=eth0 server.sweet.home` resolved correctly throughout, proving the LAN DNS server was never the actual problem. - Changes `modules/docker/mount-data.nix` to build each NFS device string from the FQDN (`server.sweet.home`) directly, sidestepping DNS search-domain behavior entirely -- matching the pattern `modules/raspi/mount-data.nix` already uses. Bare single-label names were never going to work anyway; systemd-resolved only tries LLMNR for those, never DNS search-suffixing. ## Test plan - [x] `nixpkgs-fmt --check` clean - [x] `statix` clean - [x] Full `nix eval` of every host/package succeeds - [ ] Operator: rebuild/redeploy `lxc-docker`, confirm the 5 NFS mounts come up this time

beatzaplenty added 1 commit 2026-07-21 02:35:27 +00:00

Fix NFS mount device strings on lxc-docker: use FQDN, not search domain

Check NixOS configurations / eval-hosts (pull_request) Successful in 17m29s

Details

42da626397

The previous commit's networking.search fix was wrong. Confirmed live
on lxc-docker (vmid 105) after redeploying with it: `resolvectl query
server.sweet.home` started failing again, even though
`resolvectl query --interface=eth0 server.sweet.home` still resolved
correctly to the right IP via the LAN's real DNS server. The debug log
showed why -- adding a *global* search domain via networking.search
gave systemd-resolved a domain-matched but server-less "global" scope,
which it now prioritizes over eth0's correctly-configured scope for
every "*.sweet.home" query, silently sending them to public fallback
DNS (1.1.1.1 et al) instead, which of course returns NXDOMAIN for an
internal-only name. Bare single-label names (e.g. "server") were never
going to work either way -- systemd-resolved only ever tries LLMNR for
those, never DNS search-suffixing, regardless of configuration.

Reverts the networking.search addition and instead has
modules/docker/mount-data.nix build each NFS device string from
"${vars.nfsServerHost}.${vars.homeDomain}" (a plain FQDN, no dependency
on search-domain behavior at all) -- the same pattern
modules/raspi/mount-data.nix already uses for the Raspberry Pi's share
and for the identical reason.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T48qgH3VTvs8wvwj44FEbE

beatzaplenty merged commit 33c9506c7d into main

2026-07-21 04:26:39 +00:00

beatzaplenty referenced this pull request

2026-07-21 08:48:32 +00:00

Make lxc-docker a privileged container: unprivileged can't NFS-mount at all #28

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#25