dnsd — authoritative mesh DNS

dnsd answers authoritative DNS queries over UDP and TCP for the zones in an explicit strict-data zones.mix file. It refuses names outside its authority and does not recurse. The private dns-core crate owns the zone model, parsing, snapshots, persistence, resolver and wire codec.

/opt/mixos/bin/dnsd --zones /opt/mixos/etc/dnsd/zones.mix --state /var/lib/mixos/dnsd/state --listen 127.0.0.1:5353

All three arguments are required. Repeat --listen to bind more than one address. Wildcard binds are refused. The default mixos feature reads node.conf.mix using config (including MIXOS_ETC and MIXOS_NODE_CONFIG) and accepts the configured WireGuard IP or loopback. If node configuration is absent or invalid, non-loopback binds require --allow-non-loopback-listen, with a warning. The standalone build (--no-default-features) always uses this explicit-flag posture. The citizen retries unavailable bind addresses for up to 30 seconds.

The example zone schema is in services/dnsd/tests/fixtures/zones.mix. Operators supply their own zones; the fixture is test data. SIGHUP reloads the file, preserving the last good snapshot on failure. Persisted serial floors retain their existing v1 format, so a binary rollback can read state written by this port.

The dnsd Bus service exposes two read-only queries:

DNS serving continues while the broker is unavailable. Registration retries with bounded exponential backoff. Mutation verbs are rejected.

services/dnsd/units/dnsd.service runs /opt/mixos/bin/dnsd as dnsd, with UID and GID 506, CAP_NET_BIND_SERVICE and the original hardening. Its config root is MIXOS_ETC=/opt/mixos/etc, with dnsd/zones.mix and dnsd/service.env (LISTEN=192.0.2.10:53). Its state root is MIXOS_VAR=/var/lib/mixos, with dnsd/state. The unit sets those roots explicitly; changing the roots also requires overriding its argument and environment-file paths. Node identity comes from /opt/mixos/etc/node.conf.mix. The sysusers and tmpfiles fragments are owned by the component. Installing these files does not activate DNS.

cargo test --locked -p dnsd
cargo test --locked -p dns-core
cargo test --locked -p dnsd --no-default-features
cargo build --release --locked -p dnsd

Run Rust commands on the configured build worker. The integration prober starts a temporary loopback daemon, drives real UDP and TCP queries and retains the source load guard for timing assertions. --version --json reports the package, version, build commit and timestamp.