rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Order network jobs after DNS readiness

Browse source
This commit is contained in:
rope 2026-09-15 13:50:03 +01:00
parent 23e1fa7a0c
commit 85b1c3ecbf
3 changed files with 45 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
services/adguard.nix
View file

@ -1,5 +1,27 @@
# services/adguard.nix — AdGuard Home network-wide DNS ad blocker
{ config, lib, pkgs, ... }:
let
# AdGuard Home uses Type=simple, so systemd considers it started before its
# DNS listeners are necessarily accepting queries. Network-dependent units
# ordered after adguardhome.service need a stronger readiness boundary.
waitForDns = pkgs.writeShellScript "wait-for-adguard-dns" ''
attempt=0
while [ "$attempt" -lt 30 ]; do
# dnsmasq may answer on loopback while AdGuard is still starting, so
# probe AdGuard's exclusive LAN listener instead.
if answer="$(${pkgs.dnsutils}/bin/dig +short +time=1 +tries=1 @10.0.0.1 example.com A 2>/dev/null)"; then
if [ -n "$answer" ]; then
exit 0
fi
fi
attempt=$((attempt + 1))
${pkgs.coreutils}/bin/sleep 1
done
echo "AdGuard Home did not provide working upstream DNS within 30 seconds" >&2
exit 1
'';
in
{
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
@ -45,6 +67,10 @@
};
};
# Delay completion of adguardhome.service startup until DNS is genuinely
# usable, rather than merely until the AdGuard process has been spawned.
systemd.services.adguardhome.serviceConfig.ExecStartPost = [ waitForDns ];
# LAN clients reach :53 via the nftables "LAN trusted" rule in router.nix;
# WAN:53 is dropped there.
};

7
services/cloudflare-ddns.nix
View file

@ -7,5 +7,12 @@
apiTokenFile = "/var/secrets/cloudflare-token";
domains = [ "nordhammer.it" ];
};
# network-online.target stays active while AdGuard is restarted during
# deployment. Wait for AdGuard's DNS-readiness check as well.
systemd.services.cloudflare-dyndns = {
after = [ "network-online.target" "adguardhome.service" ];
wants = [ "network-online.target" "adguardhome.service" ];
};
};
}

12
services/crowdsec.nix
View file

@ -142,5 +142,17 @@ in
enable = true;
registerBouncer.enable = true;
};
# CrowdSec setup and hub refresh both contact the upstream hub. The
# generic online target does not become inactive when local DNS restarts,
# so explicitly order these jobs after AdGuard's DNS-readiness check.
systemd.services.crowdsec-setup = {
after = [ "adguardhome.service" ];
wants = [ "adguardhome.service" ];
};
systemd.services.crowdsec-update-hub = {
after = [ "adguardhome.service" ];
wants = [ "adguardhome.service" ];
};
};
}