mirror of
https://github.com/jmcorgan/fips.git
synced 2026-07-30 19:46:15 +00:00
Johnathan Corgan
b33d6531ce
The fips-dns.service unit had three issues: 1. Wants=systemd-resolved.service caused systemd to start systemd-resolved on systems that weren't using it, breaking existing DNS by rewriting /etc/resolv.conf to the stub resolver at 127.0.0.53. 2. The ExecStart busy-wait loop for fips0 had no timeout, hanging forever if fips.service failed to create the TUN device. 3. Installers unconditionally enabled fips-dns.service regardless of whether systemd-resolved was present. Fix by replacing Wants= with ConditionPathExists=/run/systemd/resolve (skips cleanly if resolved isn't running), adding Requires=fips.service (won't start without the daemon), bounding the fips0 wait loop to 30 seconds, and making the installers conditional on systemd-resolved being active.
24 lines
600 B
Desktop File
24 lines
600 B
Desktop File
[Unit]
|
|
Description=Configure DNS routing for .fips domain
|
|
After=fips.service systemd-resolved.service
|
|
Requires=fips.service
|
|
ConditionPathExists=/run/systemd/resolve
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/bin/bash -c '\
|
|
for i in $(seq 1 30); do \
|
|
ip link show fips0 >/dev/null 2>&1 && break; \
|
|
sleep 1; \
|
|
done; \
|
|
if ! ip link show fips0 >/dev/null 2>&1; then \
|
|
echo "fips0 interface not found after 30s" >&2; \
|
|
exit 1; \
|
|
fi; \
|
|
/usr/bin/resolvectl dns fips0 127.0.0.1:5354; \
|
|
/usr/bin/resolvectl domain fips0 ~fips'
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|