From 5324b5472c4fa9cd48d9c206d1e65092878189bb Mon Sep 17 00:00:00 2001 From: ulve Date: Sat, 24 Oct 2026 14:48:48 +0200 Subject: [PATCH] nixserve: stop Tailscale from hijacking DNS resolution Tailscale's stub resolver (100.100.100.100) intermittently times out or SERVFAILs under bursty concurrent lookups (a known upstream issue, e.g. tailscale/tailscale#6850, #10768, #8829), which was breaking HACS updates in the Home Assistant container (network_mode: host, so it inherits nixserve's own resolv.conf). Point nixserve at the local Pi-hole instead and disable Tailscale's accept-dns so it can't override it. Co-Authored-By: Claude Sonnet 5 --- hosts/nixserve/default.nix | 5 +++++ hosts/nixserve/services.nix | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/hosts/nixserve/default.nix b/hosts/nixserve/default.nix index 0654e19..b42de03 100644 --- a/hosts/nixserve/default.nix +++ b/hosts/nixserve/default.nix @@ -9,6 +9,11 @@ networking.hostName = "nixserve"; networking.hostId = "941b956b"; networking.networkmanager.enable = true; + # nixserve's own DNS lookups (e.g. HACS/docker pulls) go to the local Pi-hole + # first instead of detouring through Tailscale's DNS proxy -> home router, + # which was timing out under HACS's bursty concurrent lookups. Tailscale's + # MagicDNS resolver (100.100.100.100) stays as a fallback nameserver. + networking.nameservers = [ "127.0.0.1" ]; boot.supportedFilesystems = [ "zfs" ]; boot.zfs.forceImportRoot = false; diff --git a/hosts/nixserve/services.nix b/hosts/nixserve/services.nix index 77d8914..534b7a2 100644 --- a/hosts/nixserve/services.nix +++ b/hosts/nixserve/services.nix @@ -67,6 +67,12 @@ in enable = true; openFirewall = true; useRoutingFeatures = "server"; + # Don't let Tailscale take over nixserve's own DNS resolution: its stub + # resolver (100.100.100.100) intermittently times out under bursty lookups + # (a known upstream issue, e.g. tailscale/tailscale#6850, #10768, #8829), + # which broke HACS updates. nixserve resolves via local Pi-hole instead + # (see networking.nameservers in hosts/nixserve/default.nix). + extraSetFlags = [ "--accept-dns=false" ]; }; services.syncthing = {