From f99a34959d7f9eb47739fa564aa1bbf067a57b21 Mon Sep 17 00:00:00 2001
From: Sridhar Ratnakumar <srid@srid.ca>
Date: Sat, 23 May 2026 10:27:31 -0400
Subject: [PATCH] i

---
 docs/LINUX-INTERNET-ISSUES.md   | 51 +++++++++++++++++++++++++++++++++
 modules/nixos/linux/anywhen.nix | 16 +++++++++++
 2 files changed, 67 insertions(+)
 create mode 100644 modules/nixos/linux/anywhen.nix

diff --git a/docs/LINUX-INTERNET-ISSUES.md b/docs/LINUX-INTERNET-ISSUES.md
index 96753ae..e349881 100644
--- a/docs/LINUX-INTERNET-ISSUES.md
+++ b/docs/LINUX-INTERNET-ISSUES.md
@@ -239,6 +239,57 @@ ping -c 2 -W 2 1.1.1.1
 curl -4 -sS --connect-timeout 4 --max-time 8 https://github.com >/dev/null
 ```
 
+## Variant: MagicDNS with no upstream resolver
+
+Different outage, similar-looking symptom: `/etc/resolv.conf` again pointed only
+at `100.100.100.100`, but this time IP-layer routing was healthy and the cause
+was purely DNS.
+
+Symptoms:
+
+- `ping 1.1.1.1` works.
+- `ping google.com` fails with `Name or service not known`.
+- `getent hosts github.com` returns nothing.
+- `*.ts.net` lookups still work (split-DNS route is independent).
+
+Smoking gun in `journalctl -u tailscaled`:
+
+```text
+dns: resolver: forward: no upstream resolvers set, returning SERVFAIL
+```
+
+And `tailscale dns status` shows:
+
+```text
+Resolvers (in preference order):
+  (no resolvers configured, system default will be used: see 'System DNS configuration' below)
+...
+  (failed to read system DNS configuration: Access denied: dns-osconfig dump access denied)
+```
+
+What's happening: Tailscale is managing `/etc/resolv.conf` (`accept-dns=true`)
+and MagicDNS handles `*.ts.net` via the split-DNS route, but for every other
+query it needs an upstream resolver. If the tailnet admin console has no
+**Global nameservers** configured, Tailscale tries to fall back to the device's
+system DNS — which on NixOS/tailscale 1.98 fails with the `dns-osconfig`
+access-denied error above. Result: SERVFAIL for everything non-tailnet.
+
+Fix in the admin console at <https://login.tailscale.com/admin/dns>:
+
+1. Under **Global nameservers**, add an upstream (e.g. Cloudflare `1.1.1.1`).
+2. Turn **Override DNS servers ON**. With it off, the global nameserver is only
+   used when the device's own OS DNS is readable — which on this host it isn't.
+
+Netmap propagation is near-instant; no daemon restart needed. Verify:
+
+```bash
+ssh pureintent 'tailscale dns status | sed -n "/Resolvers/,/Split/p"'
+ssh pureintent 'getent hosts github.com && ping -c2 google.com'
+```
+
+The "Resolvers (in preference order)" list should now contain the upstream IPs
+instead of `(no resolvers configured ...)`.
+
 ## Main lesson
 
 When both Ethernet and Wi-Fi are on the same subnet, a stale primary interface can
diff --git a/modules/nixos/linux/anywhen.nix b/modules/nixos/linux/anywhen.nix
new file mode 100644
index 0000000..9b380ec
--- /dev/null
+++ b/modules/nixos/linux/anywhen.nix
@@ -0,0 +1,16 @@
+{ flake, pkgs, ... }:
+
+let
+  inherit (flake) inputs;
+in
+{
+  imports = [
+    inputs.anywhen.nixosModules.default
+  ];
+
+  services.anywhen = {
+    enable = true;
+    package = inputs.anywhen.packages.${pkgs.stdenv.hostPlatform.system}.default;
+    port = 6111;
+  };
+}