From df822062f79ac067751b6667f132e6a3d0572bb5 Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Mon, 8 Jun 2026 12:08:49 +0200 Subject: [PATCH] fix(toolbox): unbound listener for br-lxc + auto-resolve from any LXC (ref #498) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phase 7.E.3 follow-up — every LXC on br-lxc (10.100.0.0/24) had DNS=10.100.0.1 from its static config but the host Unbound only listened on 10.99.x (the WG subnets shipped in Phase 7.E.1 by 99-secubox-wg.conf). External DNS from inside any LXC failed silently. Symptom found 2026-06-08 : the Gitea pull-mirror that lives in the gitea LXC was failing to sync from upstream github.com/CyberMind-FR/secubox-deb with : Stderr: fatal: unable to access 'https://github.com/CyberMind-FR/secubox-deb.git/': Could not resolve host: github.com Failure dated back to 2026-05-17 (the day before the last successful sync). No retry alert because the mirror is "schedule, log, move on" and Gitea doesn't promote DNS errors to dashboard warnings. The Gitea mirror operator only noticed because someone checked the repo was 3 weeks behind master. Fix : new unbound drop-in 98-secubox-lxc.conf listens on 10.100.0.1 with access-control 10.100.0.0/24 allow. Postinst now installs both drop-ins (wg + lxc) in one pass. Live verified : `getent hosts github.com` from inside gitea LXC returns 140.82.121.4 ; the next mirror tick (10 min for secubox/secubox-deb, 8 h for gandalf/secubox-deb) catches up the ~50 missing commits automatically. --- packages/secubox-toolbox/debian/changelog | 18 +++++++++++++++ packages/secubox-toolbox/debian/postinst | 22 +++++++++++++------ packages/secubox-toolbox/debian/rules | 4 ++++ .../unbound/98-secubox-lxc.conf | 14 ++++++++++++ 4 files changed, 51 insertions(+), 7 deletions(-) create mode 100644 packages/secubox-toolbox/unbound/98-secubox-lxc.conf diff --git a/packages/secubox-toolbox/debian/changelog b/packages/secubox-toolbox/debian/changelog index 01185aec..85811e03 100644 --- a/packages/secubox-toolbox/debian/changelog +++ b/packages/secubox-toolbox/debian/changelog @@ -1,3 +1,21 @@ +secubox-toolbox (2.3.3-1~bookworm1) bookworm; urgency=medium + + * Phase 7.E.3 (#498) — new unbound drop-in + `98-secubox-lxc.conf` makes Unbound listen on 10.100.0.1 (br-lxc + gateway) with access-control allowing 10.100.0.0/24. Without it + every LXC on br-lxc has DNS=10.100.0.1 from its static config but + Unbound was only listening on 10.99.x (the WG subnets shipped in + Phase 7.E by 99-secubox-wg.conf). All external DNS queries from + inside any LXC failed silently for 3 weeks — symptom found when + checking why the Gitea mirror sync towards github.com hadn't run + since 2026-05-17 : "fatal: unable to access ...: Could not + resolve host: github.com". The Phase 6.J + 7.E pulls had no + reason to detect this earlier — no LXC needed external DNS + until the mirror sync started failing. + Postinst now installs both drop-ins atomically. + + -- Gérald Kerma lun., 08 juin 2026 10:08:49 +0000 + secubox-toolbox (2.3.2-1~bookworm1) bookworm; urgency=medium * Phase 7 follow-up (#498) — wg LXC : privileged mode + listen-host diff --git a/packages/secubox-toolbox/debian/postinst b/packages/secubox-toolbox/debian/postinst index 1bd3eb85..494d5512 100755 --- a/packages/secubox-toolbox/debian/postinst +++ b/packages/secubox-toolbox/debian/postinst @@ -123,13 +123,21 @@ fi fi fi - # Phase 7 (#498) : install unbound listener for wg-toolbox + captive AP. - # Without it WG peers' DNS queries to 10.99.1.1 (or legacy 10.99.0.1) - # get ICMP port unreachable and the iPhone stops resolving names. - if [ -f /usr/share/secubox/toolbox/unbound/99-secubox-wg.conf ] \ - && [ -d /etc/unbound/unbound.conf.d ]; then - install -m 0644 /usr/share/secubox/toolbox/unbound/99-secubox-wg.conf \ - /etc/unbound/unbound.conf.d/99-secubox-wg.conf + # Phase 7 (#498) : install unbound listeners. + # 99-secubox-wg.conf — WG peers (10.99.x). Without it WG peers' DNS + # queries get ICMP port unreachable and the iPhone stops resolving. + # 98-secubox-lxc.conf — br-lxc (10.100.0.x). Without it every LXC + # that uses DNS=10.100.0.1 (default route) gets nothing back, and + # things like Gitea mirror sync towards GitHub fail with + # "Could not resolve host" (3-week silent regression found + # 2026-06-08). + if [ -d /etc/unbound/unbound.conf.d ]; then + for f in 99-secubox-wg.conf 98-secubox-lxc.conf; do + if [ -f "/usr/share/secubox/toolbox/unbound/$f" ]; then + install -m 0644 "/usr/share/secubox/toolbox/unbound/$f" \ + "/etc/unbound/unbound.conf.d/$f" + fi + done if systemctl is-active --quiet unbound.service 2>/dev/null; then systemctl restart unbound.service 2>/dev/null || true fi diff --git a/packages/secubox-toolbox/debian/rules b/packages/secubox-toolbox/debian/rules index 234f5737..0c429d4b 100755 --- a/packages/secubox-toolbox/debian/rules +++ b/packages/secubox-toolbox/debian/rules @@ -64,6 +64,10 @@ override_dh_strip: install -d debian/secubox-toolbox/usr/share/secubox/toolbox/unbound install -m 0644 unbound/99-secubox-wg.conf \ debian/secubox-toolbox/usr/share/secubox/toolbox/unbound/ + # Phase 7.E.3 (#498) : also serve br-lxc (10.100.0.0/24) so every LXC + # can resolve external names through unbound. + install -m 0644 unbound/98-secubox-lxc.conf \ + debian/secubox-toolbox/usr/share/secubox/toolbox/unbound/ # Phase 7 (#498) : nginx route + rate-limit install -d debian/secubox-toolbox/etc/nginx/secubox-routes.d install -m 0644 nginx/toolbox.conf \ diff --git a/packages/secubox-toolbox/unbound/98-secubox-lxc.conf b/packages/secubox-toolbox/unbound/98-secubox-lxc.conf new file mode 100644 index 00000000..67f4f699 --- /dev/null +++ b/packages/secubox-toolbox/unbound/98-secubox-lxc.conf @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: LicenseRef-CMSD-1.0 +# Phase 7.E.3 (#498) — serve DNS to the br-lxc bridge (10.100.0.0/24). +# +# Without this, every LXC on br-lxc has DNS=10.100.0.1 from its static +# config but Unbound only listens on 10.99.x — so getent / curl / dig +# from inside any LXC fails to resolve external names. Symptom found +# 2026-06-08 : Gitea LXC mirror sync towards github.com had been +# failing silently for 3 weeks with "Could not resolve host: +# github.com". + +server: + interface: 10.100.0.1 + ip-transparent: yes + access-control: 10.100.0.0/24 allow