Dear Maintainer,

I've just had a failure of my postgresql cluster starting.  But that's
because it couldn't resolve `localhost` for the address to bind to.

Checking `named.service` journal logs this is because queries came in
during the same second the service was starting, but before the relevant
local zone (`dsl.miggy.org` in this case) was loaded.  Thus the queries
got refused and postgresql failed to start.

The systemd unit for `named.service` states it is `Type=notify`, which
means it should be sending a `READY=1` message to `sd_notify` when it is
actually ready.  It appears this is being sent too soon.  named is *not*
ready until it has its zones loaded.

If it is changed to correctly notify when it's *actually* ready then I
could gate other units, such as my postgresql cluster, on either
`named.service` startup being complete, or perhaps on
`nss-service.target`.  As it is this would have no benefit currently.

Relevant logging:

Sep 26 08:09:28 tuesday named[3454]: client @0x7ff3b4a3a000 192.168.1.1#33211 (localhost.dsl.miggy.org): query failed (zone not loaded) for localhost.dsl.miggy.org/IN/A at query.c:5738
...
Sep 26 08:09:28 tuesday named[3454]: network unreachable resolving 'localhost/A/IN': 2001:503:ba3e::2:30#53
Sep 26 08:09:28 tuesday named[3454]: network unreachable resolving 'localhost/AAAA/IN': 2001:500:2f::f#53
...
Sep 26 08:09:28 tuesday named[3454]: zone dsl.miggy.org/IN: loaded serial 2026092100
Sep 26 08:09:28 tuesday named[3454]: all zones loaded

Note how the lack of a local zone for `localhost` resolution is causing
it to *also* create extra load on the root servers.  Far more than the
two I listed above were logged.

I believe there was some change, in the bookworm>trixie transition,
to no longer have a stub zone for `localhost`, which might have negated
this issue.  That was the old `db.0` zone.  I'm unaware of the reasons
this was removed, but perhaps its reintroduction could be considered,
especially as init systems other than systemd are still supported in
Debian, and I don't know if they have a similar mechanism to "Type=notify"
to resolve this.

If you can’t resolve localhost via nss, it seems to be a local configuration error rather than bug in named.

https://kb.isc.org/docs/aa-00800

Ondrej
--
Ondřej Surý (He/Him)

A gentle nudge is always appreciated if I take a little longer to reply.

  Ah, indeed, it seems that *something* changed my /etc/hosts to 0640,
now fixed.  I'll have to see if I can track down what did it, as git
history claims it was still 644 just 5 days ago.  Unfortunately I
changed it back before checking the ctime on it for a hint.

  Thanks for the hint, and sorry for the noise.

Control: close -1