Archived
beatzaplentyandClaude Sonnet 4.6
36f5ebdf86
FreeIPA (the new authoritative DNS) cannot reach 100.100.100.100
(Tailscale's internal MagicDNS resolver) directly because the DC is not
a Tailscale node. The tailscale-router IS a Tailscale node and can
reach 100.100.100.100 via tailscale0, so it now runs a dnsmasq
instance on its LAN interface that forwards all ts.net queries to
Tailscale's resolver.
After deploying this host, configure FreeIPA with:
kinit admin
ipa dnsforwardzone-add ts.net \
--forwarder=192.168.2.222 \
--forward-policy=only
This replaces Pi-hole's conditional forwarder for ts.net and restores
resolution of Tailscale MagicDNS names (e.g. raspberrypi.tail13f623.ts.net)
for all LAN hosts using FreeIPA as their DNS server.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ULXzafSDwGhmFGnn3LtDSQ
46 lines
1.9 KiB
Nix
46 lines
1.9 KiB
Nix
{ vars, ... }:
|
|
|
|
{
|
|
# Run dnsmasq on the LAN interface as a forwarding-only resolver for
|
|
# *.ts.net (Tailscale MagicDNS names). FreeIPA's bind-dyndb-ldap
|
|
# cannot reach 100.100.100.100 (Tailscale's internal resolver) directly
|
|
# because the DC is not a Tailscale node. This host IS a Tailscale node
|
|
# and can reach 100.100.100.100 via its tailscale0 interface, so it
|
|
# acts as an intermediary: FreeIPA has a conditional forward zone for
|
|
# ts.net pointing here (vars.tailscaleRouterIp), and this dnsmasq
|
|
# instance forwards those queries onward to Tailscale's resolver.
|
|
#
|
|
# Configure FreeIPA once after deploying this host:
|
|
# kinit admin
|
|
# ipa dnsforwardzone-add ts.net \
|
|
# --forwarder=${vars.tailscaleRouterIp} \
|
|
# --forward-policy=only
|
|
services.dnsmasq = {
|
|
enable = true;
|
|
settings = {
|
|
# Listen only on the LAN interface — not tailscale0 or loopback.
|
|
# bind-interfaces prevents dnsmasq from binding to 0.0.0.0 and
|
|
# then filtering by interface later; combined with `interface` this
|
|
# ensures it genuinely listens only on eth0.
|
|
bind-interfaces = true;
|
|
interface = [ vars.lxcLanInterface ];
|
|
|
|
# Forward-only: no local /etc/hosts or /etc/resolv.conf reading,
|
|
# no negative caching of NXDOMAIN for names this instance doesn't
|
|
# serve. All ts.net queries come from FreeIPA's conditional forwarder
|
|
# and must be answered by Tailscale's resolver.
|
|
no-hosts = true;
|
|
no-resolv = true;
|
|
|
|
# Tailscale's internal "Quad100" resolver — reachable from any
|
|
# Tailscale node via the tailscale0 interface. All *.ts.net queries
|
|
# (MagicDNS hostnames like raspberrypi.tail13f623.ts.net) are
|
|
# forwarded here exclusively.
|
|
server = [ "/ts.net/100.100.100.100" ];
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
networking.firewall.allowedTCPPorts = [ 53 ];
|
|
}
|