fix(tailscale-router): stop dnsmasq from intercepting host DNS queries #79

Merged

beatzaplenty merged 1 commits from worktree-peaceful-stirring-noodle into main

2026-07-27 23:27:34 +00:00

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	c7bbf88dce	fix(tailscale-router): stop dnsmasq from intercepting host DNS queries Check NixOS configurations / eval-hosts (pull_request) Successful in 10m30s Details NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds 127.0.0.1 to networking.nameservers and binds dnsmasq to listen-address=127.0.0.1. This made the host route all its own DNS through dnsmasq, which had no-resolv=true and no upstream for anything outside the tailnet domain — so every non-tailscale DNS query from the host itself (including SSSD resolving the IPA server FQDN after the IPA client module was added) failed. Setting resolveLocalQueries=false limits dnsmasq to its intended role: a forwarding proxy reachable on the LAN interface for IPA's conditional forwarder. The host uses domainControllerIp directly (already set in networking.nameservers in host.nix). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-28 09:26:50 +10:00

Author

SHA1

Message

Date

beatzaplentyandClaude Sonnet 4.6

c7bbf88dce

fix(tailscale-router): stop dnsmasq from intercepting host DNS queries

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m30s

Details

NixOS's dnsmasq module defaults resolveLocalQueries to true, which adds
127.0.0.1 to networking.nameservers and binds dnsmasq to listen-address=127.0.0.1.
This made the host route all its own DNS through dnsmasq, which had
no-resolv=true and no upstream for anything outside the tailnet domain —
so every non-tailscale DNS query from the host itself (including SSSD
resolving the IPA server FQDN after the IPA client module was added) failed.

Setting resolveLocalQueries=false limits dnsmasq to its intended role: a
forwarding proxy reachable on the LAN interface for IPA's conditional
forwarder. The host uses domainControllerIp directly (already set in
networking.nameservers in host.nix).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 09:26:50 +10:00