goodvin
d81a4ab3b2
The gateway (Archie) routes bbrkn domains via nft sets bbrkn_v4/bbrkn_v6 (inet filter), not the legacy ipset. bbrkn was still emitting dead `ipset=/domain/bbrkn` directives (no such ipset exists) plus a 92-resolve pointing at 8.8.8.8, both overridden by hand-maintained files on the host. This makes bbrkn the generator of record for the real scheme. generate-configs.sh: - emit `nftset=/domain/$NFTSET_SPEC` (default 4#inet#filter#bbrkn_v4, 6#inet#filter#bbrkn_v6) into 90-nftset.conf instead of ipset= into 91-ipset-bbrkn.conf - DNS_SERVER default 8.8.8.8 -> 127.0.0.1#5350 (host dnsmasq pihole delegates bbrkn domains to for VPN resolution + nftset capture) deploy-to-gateway.sh: two targets, two instances - 90-nftset.conf -> host /etc/dnsmasq.d (:5350), 92-resolve -> pihole - full restart of both (dnsmasq SIGHUP does NOT re-read nftset=/server=) - flush nft sets bbrkn_v4/bbrkn_v6 instead of `ipset flush bbrkn` - add end-to-end nftset-capture health check via :5350 - rollback restores both files and restarts both instances Makefile/workflow: rename IPSET_CONF->NFTSET_CONF, add NFTSET_TARGET_DIR and HOST_DNSMASQ_SVC, DNS_SERVER=127.0.0.1#5350 (escaped `\#` in Make, quoted in YAML), note runner is ephemeral (cold gekata crawl). Docs: README + new CLAUDE.md describe the two-dnsmasq / nft-set model; exit-node DPI failover (10.77.1.2/10.77.2.2) documented as external (wg-ha.service), not owned by bbrkn. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
63 lines
2.2 KiB
YAML
63 lines
2.2 KiB
YAML
name: Deploy DNS Configuration
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
workflow_dispatch: # Ручной запуск из UI
|
|
|
|
jobs:
|
|
deploy:
|
|
runs-on: self-hosted # Используем self-hosted runner на шлюзе
|
|
env:
|
|
DEBUG: 1
|
|
DEBUG_LOG: /tmp/generate-configs.debug.log
|
|
# ==== Конфигурация проекта ====
|
|
DOMAINS_FILE: domains.txt
|
|
|
|
# Временные конфиги (куда пишутся generate-configs.sh)
|
|
NFTSET_CONF: /tmp/90-nftset.conf
|
|
RESOLVE_CONF: /tmp/92-resolve-bbrkn.conf
|
|
|
|
# Резолвер, которому pihole делегирует bbrkn-домены (host dnsmasq :5350).
|
|
# Кавычки обязательны — '#' иначе может трактоваться как комментарий.
|
|
DNS_SERVER: "127.0.0.1#5350"
|
|
|
|
# Gekata
|
|
CHROME_SERVER: http://10.77.1.2:3000
|
|
|
|
# nftset-таргет: host-инстанс dnsmasq (:5350) грузит /etc/dnsmasq.d
|
|
NFTSET_TARGET_DIR: /etc/dnsmasq.d
|
|
|
|
# resolve-таргет: pihole (docker) делегирует bbrkn-домены на :5350
|
|
TARGET_DIR: /opt/appdata/pihole/etc/dnsmasq.d
|
|
|
|
# Имя контейнера Pi-hole
|
|
DOCKER_CONTAINER: pihole
|
|
|
|
# systemd-сервис host-инстанса dnsmasq
|
|
HOST_DNSMASQ_SVC: dnsmasq
|
|
|
|
IGNORE_PARTS: "doubleclick yandex mail.ru bigsv.ru mts.ru rambler.ru yadro.ru aif.ru vkvideo.ru tns-counter.ru st.vk.com vk.com"
|
|
|
|
# Кэш API-ответов (self-hosted runner сохраняет workspace между запусками)
|
|
CACHE_DIR: .cache/api
|
|
CACHE_TTL_DAYS: 15
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Run workflow (clean → all)
|
|
run: |
|
|
make clean
|
|
make all
|
|
|
|
- name: Upload configs as artifacts
|
|
if: always() # Загружаем артефакты даже при падении — для отладки
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: dnsmasq-configs
|
|
path: |
|
|
${{ env.NFTSET_CONF }}
|
|
${{ env.RESOLVE_CONF }}
|
|
${{ env.DEBUG_LOG }}
|