Andreas WredeandClaude Fable 5
a304b6d197
Snapshot of the Pi 'wan' Claude memory: wayback van-router build notes, ZT DNS, HA VM, LAN port, and the Pi port memory updated for the 2026-07-06 USB hub move (AP live on the Pi) and the cockpit-bridge fd-limit fix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2.6 KiB
name, description, metadata
| name | description | metadata | ||||||
|---|---|---|---|---|---|---|---|---|
| zerotier-managed-dns | How ZeroTier managed DNS (wrede.pvt over ZT) is wired on Linux hosts — zerotier-systemd-manager + networkd, NOT native ZT |
|
ZeroTier network d3ecf5726d041b2a ("suspicious_house", iface ztuga7c2kh, 192.168.196.0/24) pushes managed DNS: domain wrede.pvt, servers 192.168.196.115 + 192.168.10.5. Goal: when a host is AWAY from the home LAN, *.wrede.pvt resolves over ZeroTier.
GOTCHA: ZeroTier's native DNS push is a no-op on Linux. journalctl -u zerotier-one shows WARNING: ignoring call to LinuxEthernetTap::setDns on Linux. This is not implemented yet (ZeroTierOne#2492). So zerotier-cli set <nwid> allowDNS=1 alone does NOTHING for resolution on Linux — it's only the prerequisite that lets the pushed DNS appear in network config.
Actual mechanism = zerotier-systemd-manager (Go binary, hand-installed — NOT in the zerotier apt repo; v0.4.0 at /usr/bin/zerotier-systemd-manager). It reads ZT networks and generates /etc/systemd/network/99-<ztdev>.network with DNS= + Domains=~wrede.pvt ~<reverse zones>, then reloads systemd-networkd which applies it to systemd-resolved. Ships a .service (oneshot) + .timer (regenerates every 1 min) in /usr/lib/systemd/system/. Requires systemd-networkd enabled+active.
Setup recipe (done on wertvoll, replicated on wayback 2026-06-28):
zerotier-cli set d3ecf5726d041b2a allowDNS=1(writes networks.d/.local.conf).- Install zerotier-systemd-manager (copy binary + 2 unit files; both hosts amd64).
systemctl enable --now zerotier-systemd-manager.timer. - Ensure systemd-networkd enabled+active.
- Optional bare-hostname search: drop-in
99-<ztdev>.network.d/search.confmakingwrede.pvta SEARCH domain (no~). Verify:resolvectl status <ztdev>→ Current Scopes: DNS, the 2 servers,DNS Domain: wrede.pvt ~rev…. On-home-LAN it still prefers the LAN link for wrede.pvt (both have the domain) — that's correct; ZT is the path when off-LAN.
wayback-specific: see wayback-campervan-ap. wayback's search.conf uses Domains= (reset) then Domains=wrede.pvt ~196.168.192.in-addr.arpa ~c.e.3.d.d.f.ip6.arpa because wertvoll's plain Domains=wrede.pvt drop-in did NOT merge on wayback (same systemd 255 — cause unknown); the reset form yields the identical resolved result. An empty /etc/NetworkManager/conf.d/10-globally-managed-devices.conf was briefly added to match wertvoll, then REMOVED — confirmed not needed (removing it left ZT DNS fully working, since networkd not NM drives it). wertvoll still has it but it's incidental.