From 29c299c0fe32aaf397a713dfa1687ed6971d26f6 Mon Sep 17 00:00:00 2001 From: Claude Bot Date: Thu, 22 Oct 2026 21:55:11 +0200 Subject: [PATCH] fix(netbird-server): keep the host mesh client out of DNS The controller's own NetBird client registered ~renner.uno in systemd-resolved, pointing at the kube-dns-lb nameserver group, which is unreachable from this peer. Every *.renner.uno lookup on the host returned SERVFAIL, and Uptime Kuma, resolving through Docker's embedded DNS and the host stub, marked all HTTP monitors DOWN after the 2026-10-22 update-os reboot. The role now reconnects the client with --disable-dns when its config has DNS management enabled. The flag is only honoured on a fresh up, so the task runs netbird down + up; it is a no-op once disableDns is true. Applied live and verified 2026-10-22 before this commit. Co-Authored-By: Claude Opus 5.5 --- ansible/roles/netbird-server/tasks/main.yml | 23 +++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/ansible/roles/netbird-server/tasks/main.yml b/ansible/roles/netbird-server/tasks/main.yml index 27eaae23..3b07e3a1 100644 --- a/ansible/roles/netbird-server/tasks/main.yml +++ b/ansible/roles/netbird-server/tasks/main.yml @@ -157,6 +157,29 @@ ansible.builtin.pause: seconds: 10 +# The host's mesh client must not manage DNS: containers here resolve through +# the host stub, and the renner.uno nameserver group is unreachable from it. +- name: Check for the host NetBird client + ansible.builtin.stat: + path: /usr/bin/netbird + register: _netbird_client + +- name: Read the host NetBird client config + ansible.builtin.command: netbird debug config + register: _netbird_client_config + changed_when: false + when: _netbird_client.stat.exists + +# disable-dns is only applied on a fresh `up`, not to a connected client. +- name: Reconnect the host NetBird client with DNS management disabled + ansible.builtin.shell: | + set -eu + netbird down + netbird up --disable-dns + when: + - _netbird_client.stat.exists + - not (_netbird_client_config.stdout | from_json).disableDns + - name: Display deployment status ansible.builtin.debug: msg: | -- 2.54.0