kevinveenbirkenbachandClaude Opus 5 da09ee575b fix(coredns): answer every record type for the test zone instead of forwarding it ...

The CI zone served A and AAAA for INFINITO_DOMAIN and let every other type fall through to the public resolvers, which return NXDOMAIN for the reserved .test TLD. Per RFC 2308 that denial covers the whole name, not the queried type, so any caching resolver in front of CoreDNS applies it to the A record the deployment depends on.

Without such a cache nobody noticed: Mastodon's EmailMxValidator asks MX, takes the NXDOMAIN, then asks A anyway and gets the address. On a Tor node svc-net-tor puts dnsmasq in front, the denial is cached, and tootctl accounts create ends on 'Failure/Error: email unreachable'. It cost Fediwall#0 and Fediwall#2 in run 34653542922 and Fediwall#2 in run 34653754175, all three compose plus tor; the same two jobs passed in run 34614940508 as compose without tor, same command, same administrator@infinito.test, rc 0.

A template with no answer returns NOERROR with an empty answer section and the SOA in authority, so the zone denies a type without denying the name. It sits after the A and AAAA templates, which would otherwise have their names answered NODATA, and before forward, so no type escapes.

Measured against 172.30.0.53 in the running stack: infinito.test MX went from NXDOMAIN with an authority record to NOERROR with zero answers and the aa flag, infinito.test A and auth.infinito.test A still return 172.30.0.10, and deb.debian.org still resolves through the forward.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-12 09:35:58 +02:00

..

inventory

feat(variants): let a variant dictate the config of the providers it pulls in

2026-09-01 21:08:08 +02:00

__init__.py

…

test_compose.py

fix(env): write the cache-stack declaration from a handler, not the registry

2026-08-23 23:24:15 +02:00

test_coredns.py

fix(coredns): answer every record type for the test zone instead of forwarding it

2026-09-12 09:35:58 +02:00

test_down.py

…

test_env_compose_file_args.py

fix(env): write the cache-stack declaration from a handler, not the registry

2026-08-23 23:24:15 +02:00

test_exec.py

…

test_inventory_vars_file_spot.py

…

test_matrix_deploy.py

…

test_mirrors.py

…

test_network.py

…

test_profile.py

fix(env): write the cache-stack declaration from a handler, not the registry

2026-08-23 23:24:15 +02:00

test_variant_select.py

…