Mikaela/shell-things
1
0
Fork 0
mirror of https://gitea.blesmrt.net/mikaela/shell-things.git synced 2024-11-22 03:09:22 +01:00
Code Issues Projects Releases Wiki Activity

DNS: fail fast when you inevitably fail

Browse Source
This commit is contained in:
Aminda Suomalainen 2024-07-30 20:42:10 +03:00
parent 21bd1b2290
commit aa03a16c49
Signed by: Mikaela
SSH Key Fingerprint: SHA256:CXLULpqNBdUKB6E6fLA1b/4SzG0HvKD19PbIePU175Q
7 changed files with 13 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
etc/resolv.conf
View File

@ -29,8 +29,8 @@ nameserver 127.0.0.53
# no sending local domain to upstream whenever NXDOMAIN happens
search .
# timeout:2 = nameserver timeout 2 s (default 5, max 30), then next
# attempts:2 = if all nameservers fail, attempt again 2 times (def 2, max 5)
# timeout:1 = nameserver timeout 1 s (default 5, max 30), then next
# attempts:5 = if all nameservers fail, attempt again 5 times (def 2, max 5)
# rotate = For long running processes that perform more than one query (so not
# dig/host), use the first resolver for the first query, second resolver for
# the second query, third resolver for the third query and repeat.
@ -43,7 +43,7 @@ search .
# systemd-resolved instantly without the timeout of two seconds.
# edns0 = extended DNS
# trust-ad = trust DNSSEC authenticated data
options timeout:2 attempts:2 rotate edns0 trust-ad
options timeout:1 attempts:5 rotate edns0 trust-ad
# AMINDA! Remember, you are specifying these here, a couple of bash scripts
# in this directory, see the comment on top, ../rc/{bash,zsh}rc
# ($RES_OPTIONS) and systemd/system/service.d/resolv.conf !

2
etc/resolv.conf-generate.bash
View File

@ -17,7 +17,7 @@ rm -v /etc/resolv.conf
# Actual resolv.conf creation. OK, this could read resolv.conf in this
# directory, but I like this being self-contained.
# tee -p = operate in a more appropriate MODE with pipes.
printf 'nameserver ::1\nnameserver 127.0.0.1\nnameserver 127.0.0.53\nsearch .\noptions timeout:2 attempts:2 rotate edns0 trust-ad\n' | tee -p /etc/resolv.conf
printf 'nameserver ::1\nnameserver 127.0.0.1\nnameserver 127.0.0.53\nsearch .\noptions timeout:1 attempts:5 rotate edns0 trust-ad\n' | tee -p /etc/resolv.conf
# Remove all other permissions than everyone reading resolv.conf
chmod -v a=r /etc/resolv.conf

2
etc/systemd-resolv.conf-generate.bash
View File

@ -29,7 +29,7 @@ chmod -v +w /etc/resolv.conf
rm -v /etc/resolv.conf
# tee -p = operate in a more appropriate MODE with pipes.
printf 'nameserver 127.0.0.53\nnameserver 127.0.0.53\nnameserver 127.0.0.53\nsearch .\noptions timeout:2 attempts:2 rotate edns0 trust-ad\n' | tee -p /etc/resolv.conf
printf 'nameserver 127.0.0.53\nnameserver 127.0.0.53\nnameserver 127.0.0.53\nsearch .\noptions timeout:1 attempts:5 rotate edns0 trust-ad\n' | tee -p /etc/resolv.conf
# Remove all other permissions than everyone reading resolv.conf
chmod -v a=r /etc/resolv.conf

2
etc/traditional-resolv.conf-generate.bash
View File

@ -23,7 +23,7 @@ rm -v /etc/resolv.conf
# No trust-ad here as chances are these resolvers are unencrypted and the
# path to them isn't trusted.
# tee -p = operate in a more appropriate MODE with pipes.
printf "nameserver %b\nnameserver %b\nnameserver %b\nsearch .\noptions timeout:2 attempts:2 rotate edns0\n" "$1" "$2" "$3" | tee -p /etc/resolv.conf
printf "nameserver %b\nnameserver %b\nnameserver %b\nsearch .\noptions timeout:1 attempts:5 rotate edns0\n" "$1" "$2" "$3" | tee -p /etc/resolv.conf
# Remove all other permissions than everyone reading resolv.conf
chmod -v a=r /etc/resolv.conf

8
etc/unbound/unbound.conf.d/expired-stale-serving-rfc8767.conf
View File

@ -11,9 +11,11 @@ server:
serve-expired-ttl: 86400
# If serving expired data to client, explicitly give it TTL 30 seconds
serve-expired-reply-ttl: 30
# Serve expired data to client if there is no answer in 1.8 seconds as per
# common timeout 2 seconds according to the RFC 8767
serve-expired-client-timeout: 1800
# Serve expired data to client if there is no answer in 0.8 seconds as
# RFC 8767 says common seconds is 2 seconds making 1800 a reasonable
# value, but as I use a second lower timeout, I need to adjust here as
# well.
serve-expired-client-timeout: 800
# Human readable DNSSEC errors for expired records
ede-serve-expired: yes

2
rc/bashrc
View File

@ -265,7 +265,7 @@ export LSCOLORS=gxBxhxDxfxhxhxhxhxcxcx
export LOCALDOMAIN=.
# Secureish resolv.conf options (except trust-ad, but systemd also sets it
# regardless of whether DNSSEC=true or not.
export RES_OPTIONS="timeout:2 attempts:2 rotate edns0 trust-ad"
export RES_OPTIONS="timeout:1 attempts:5 rotate edns0 trust-ad"
# https://github.com/go-nv/goenv
if [ -f /home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv ]; then

2
rc/zshrc
View File

@ -219,7 +219,7 @@ export LSCOLORS=gxBxhxDxfxhxhxhxhxcxcx
export LOCALDOMAIN=.
# Secureish resolv.conf options (except trust-ad, but systemd also sets it
# regardless of whether DNSSEC=true or not.
export RES_OPTIONS="timeout:2 attempts:2 rotate edns0 trust-ad"
export RES_OPTIONS="timeout:1 attempts:5 rotate edns0 trust-ad"
# https://github.com/go-nv/goenv
if [ -f /home/linuxbrew/.linuxbrew/opt/goenv/bin/goenv ]; then