64 lines
2.8 KiB
Markdown
64 lines
2.8 KiB
Markdown
# dnsmasq — LAN wildcard DNS
|
|
|
|
> **SUPERSEDED for the default path — see `13-dns-and-run-modes.md`.** DNS is now
|
|
> your own party server (records via `tooling/dns-records.sh`); dnsmasq moved to
|
|
> an optional turnkey layer (`docker-compose.dnsmasq.yml`). Default domain is
|
|
> `.lan` (not `.local`). The wildcard/spoof template below still applies when you
|
|
> opt into dnsmasq.
|
|
|
|
## Summary
|
|
|
|
Provides name resolution for guest laptops so `*.ulicraft.local` resolves to the
|
|
Docker host. Replaces the homelab's AdGuard (dropped for the LAN party). Image:
|
|
`jpillora/dnsmasq` (dnsmasq wrapped in webproc, optional web UI on :8080).
|
|
|
|
Config is a **file**, not env-driven — `/etc/dnsmasq.conf`, standard dnsmasq
|
|
format. Rendered from a template by `tooling/render-config.sh`.
|
|
|
|
Only guest laptops point their DNS here. Stack-internal resolution is handled by
|
|
Docker network aliases on Caddy (see `02-caddy.md`), so dnsmasq is not on the
|
|
critical path for the server's own services.
|
|
|
|
## Config template
|
|
|
|
`dnsmasq/dnsmasq.conf.tmpl`:
|
|
```
|
|
# wildcard: every *.ulicraft.local → host LAN IP
|
|
address=/${BASE_DOMAIN}/${HOST_LAN_IP}
|
|
# upstream optional; party is offline so may be omitted
|
|
no-resolv
|
|
```
|
|
|
|
### Air-gap spoof records (see 11)
|
|
|
|
For full client air-gap, this file also spoofs the real upstream hosts → our
|
|
Caddy mirror (`piston-meta`/`piston-data`/`libraries.minecraft.net`/
|
|
`maven.neoforged.net`/`resources.download.minecraft.net`/`meta.prismlauncher.org`).
|
|
Full list + rationale in `11-full-airgap-mirror.md`. Keep in sync with the
|
|
capture step. Auth hosts (session/textures/api.mojang) are NOT spoofed — drasl
|
|
handles those via authlib-injector.
|
|
|
|
## Gotcha — port 53 conflict
|
|
|
|
Linux Docker hosts usually run `systemd-resolved` bound to `:53`. Publishing
|
|
`53:53` will fail with `address already in use`. Resolve by one of:
|
|
- Bind dnsmasq only to the LAN IP: publish `${HOST_LAN_IP}:53:53/udp` (+tcp)
|
|
- Or disable resolved's stub listener (`DNSStubListener=no`) and restart resolved
|
|
|
|
## Gotcha — `.local` / mDNS
|
|
|
|
See overview. Avahi may shortcut `*.local` to multicast before hitting dnsmasq.
|
|
Test on a macOS client early; if broken, switch `BASE_DOMAIN` to `.lan`.
|
|
|
|
## Tasks
|
|
|
|
- [ ] Add `dnsmasq` service to `docker-compose.yml` (`jpillora/dnsmasq`)
|
|
- [ ] Create `dnsmasq/dnsmasq.conf.tmpl` with wildcard `address=` line
|
|
- [ ] Wire `render-config.sh` to emit `dnsmasq/dnsmasq.conf` (gitignored)
|
|
- [ ] Decide port-53 strategy (bind to `HOST_LAN_IP` vs disable resolved stub)
|
|
- [ ] Publish `53/udp` + `53/tcp`; mount rendered conf read-only
|
|
- [ ] Optionally expose webproc UI (8080) behind Caddy as `dns.ulicraft.local`
|
|
- [ ] Document guest DNS setting (set DNS server = `HOST_LAN_IP`)
|
|
- [ ] Verify `*.local` resolves on Windows + macOS + Linux guests (mDNS check)
|
|
- [ ] Add air-gap spoof `address=` records (see 11) once capture confirms the host list
|