diff options
author | Florian Klink <flokli@flokli.de> | 2021-07-17 19:41:45 +0200 |
---|---|---|
committer | Florian Klink <flokli@flokli.de> | 2021-07-17 23:55:35 +0200 |
commit | c1536f5c78ead2fdcb0ec11824d673638fa6a5f4 (patch) | |
tree | d3b81c2f2ce04c82955b708be690981460123425 /nixos/doc/manual/release-notes | |
parent | b59c06dc92f8d03660eb4155754d93a6c34cda83 (diff) | |
download | nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.gz nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.bz2 nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.lz nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.xz nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.zst nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.zip |
nixos/systemd: fix NSS database ordering
- The order of NSS (host) modules has been brought in line with upstream recommendations: - The `myhostname` module is placed before the `resolve` (optional) and `dns` entries, but after `file` (to allow overriding via `/etc/hosts` / `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from hijacking `.localhost` domains) - The `mymachines` module, which provides hostname resolution for local containers (registered with `systemd-machined`) is placed to the front, to make sure its mappings are preferred over other resolvers. - If systemd-networkd is enabled, the `resolve` module is placed before `files` and `myhostname`, as it provides the same logic internally, with caching. - The `mdns(_minimal)` module has been updated to the new priorities. If you use your own NSS host modules, make sure to update your priorities according to these rules: - NSS modules which should be queried before `resolved` DNS resolution should use mkBefore. - NSS modules which should be queried after `resolved`, `files` and `myhostname`, but before `dns` should use the default priority - NSS modules which should come after `dns` should use mkAfter.
Diffstat (limited to 'nixos/doc/manual/release-notes')
-rw-r--r-- | nixos/doc/manual/release-notes/rl-2111.section.md | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md index 030f1d21818..4409ad7b436 100644 --- a/nixos/doc/manual/release-notes/rl-2111.section.md +++ b/nixos/doc/manual/release-notes/rl-2111.section.md @@ -139,3 +139,27 @@ In addition to numerous new and upgraded packages, this release has the followin - The wordpress module provides a new interface which allows to use different webservers with the new option [`services.wordpress.webserver`](options.html#opt-services.wordpress.webserver). Currently `httpd` and `nginx` are supported. The definitions of wordpress sites should now be set in [`services.wordpress.sites`](options.html#opt-services.wordpress.sites). Sites definitions that use the old interface are automatically migrated in the new option. This backward compatibility will be removed in 22.05. + +- The order of NSS (host) modules has been brought in line with upstream + recommendations: + + - The `myhostname` module is placed before the `resolve` (optional) and `dns` + entries, but after `file` (to allow overriding via `/etc/hosts` / + `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from + hijacking `.localhost` domains) + - The `mymachines` module, which provides hostname resolution for local + containers (registered with `systemd-machined`) is placed to the front, to + make sure its mappings are preferred over other resolvers. + - If systemd-networkd is enabled, the `resolve` module is placed before + `files` and `myhostname`, as it provides the same logic internally, with + caching. + - The `mdns(_minimal)` module has been updated to the new priorities. + + If you use your own NSS host modules, make sure to update your priorities + according to these rules: + + - NSS modules which should be queried before `resolved` DNS resolution should + use mkBefore. + - NSS modules which should be queried after `resolved`, `files` and + `myhostname`, but before `dns` should use the default priority + - NSS modules which should come after `dns` should use mkAfter. |