Johnathan Corgan 84976b1fa2 fips-gateway: exit when the DNS listener cannot bind or stops ...

The resolver ran as a detached task whose error was only logged, so a
gateway whose DNS port was taken stayed up with .fips resolution dead
and every health check passing.

The listener is now bound before the address pool, NAT table and routes
are created, and a bind failure exits with status 1. When the port is
already in use, the error names the service most likely to hold it and
how to find the holder with ss or netstat. A resolver task that stops
while the gateway runs also ends the process, after NAT and routes are
torn down, so systemd or procd restarts it or shows it failed.

The resolver now forwards to the upstream address the startup probe
resolved, so an upstream written as a hostname no longer passes the
probe and then kills the resolver.

The dns-resolver harness gains a check that a gateway configured on the
daemon's DNS port exits with the hint before it creates the pool or the
NAT table. The troubleshooting guide describes the new failure, and the
exit-code table no longer lists a control-socket bind failure, which
only warns.

2026-09-27 19:35:48 +00:00

..

.gitignore

Fix DNS responder silent-drop on systemd-resolved deployments

2026-04-29 12:50:11 +00:00

test.sh

fips-gateway: exit when the DNS listener cannot bind or stops

2026-09-27 19:35:48 +00:00