goodvin
660a31c35e
All checks were successful
Deploy DNS Configuration / deploy (push) Successful in 14m41s
Elements in bbrkn_v4/bbrkn_v6 carry a 1d timeout and are only refreshed when a query reaches the host dnsmasq on :5350, where the nftset= directives are applied. Idle domains — or ones answered from the pihole FTL cache — age out of the sets and their traffic silently falls back to the plain WAN route instead of the tunnel. warm-nftset.sh re-resolves every domain from the deployed 90-nftset.conf (base + related subdomains) directly against 127.0.0.1:5350, bypassing the FTL cache. Sourcing the domain list from the deployed config means there is no second list to keep in sync. Ping is off by default: packets originating on the gateway itself go through OUTPUT, never prerouting_mangle, so they leave unmarked and almost all time out — a misleading signal, not a real failure. Run on the gateway via `make warm` or hourly cron. Measured: 1059 domains in ~1m45s at PARALLEL=8, v4 526->2203, v6 305->1440 elements. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
64 lines
2.5 KiB
Makefile
64 lines
2.5 KiB
Makefile
# ===============================
|
||
# Makefile для управления dnsmasq-конфигами
|
||
# ===============================
|
||
|
||
# --- Переменные окружения (с дефолтами для локального запуска) ---
|
||
NFTSET_CONF ?= /tmp/90-nftset.conf
|
||
RESOLVE_CONF ?= /tmp/92-resolve-bbrkn.conf
|
||
CHROME_SERVER ?= http://10.77.1.2:3000
|
||
DOMAINS_FILE ?= domains.txt
|
||
# Резолвер, которому pihole делегирует bbrkn-домены (host dnsmasq :5350).
|
||
# ВНИМАНИЕ: '#' в Makefile — начало комментария, экранируем как '\#'.
|
||
DNS_SERVER ?= 127.0.0.1\#5350
|
||
NFTSET_TARGET_DIR ?= /etc/dnsmasq.d
|
||
CACHE_DIR ?= .cache/api
|
||
CACHE_TTL_DAYS ?= 15
|
||
|
||
# Экспортируем переменные, чтобы они были доступны внутри shell-скриптов
|
||
export NFTSET_CONF RESOLVE_CONF CHROME_SERVER DOMAINS_FILE DNS_SERVER NFTSET_TARGET_DIR CACHE_DIR CACHE_TTL_DAYS
|
||
|
||
# --- Основные цели ---
|
||
.PHONY: all clean cache-clean check generate deploy warm
|
||
|
||
all: generate deploy
|
||
@echo "✅ Конфиги успешно сгенерированы и задеплоены"
|
||
|
||
clean:
|
||
@echo "🧹 Очистка временных файлов"
|
||
@rm -f $(NFTSET_CONF) $(RESOLVE_CONF)
|
||
|
||
cache-clean:
|
||
@echo "🗑 Очистка кэша API ($(CACHE_DIR))"
|
||
@rm -rf $(CACHE_DIR)
|
||
@echo "✔ Кэш очищен"
|
||
|
||
check:
|
||
@echo "🔍 Проверка файла доменов ($(DOMAINS_FILE))"
|
||
@if [ ! -f "$(DOMAINS_FILE)" ]; then \
|
||
echo "Ошибка: файл $(DOMAINS_FILE) не найден"; \
|
||
exit 1; \
|
||
fi
|
||
@grep -v '^#' $(DOMAINS_FILE) | grep -v '^$$' | while read domain; do \
|
||
if ! echo "$$domain" | grep -qE '^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$$'; then \
|
||
echo "Ошибка: Неверный формат домена: $$domain"; \
|
||
exit 1; \
|
||
fi \
|
||
done
|
||
@echo "✔ Файл доменов прошёл проверку"
|
||
|
||
generate:
|
||
@echo "⚙ Генерация dnsmasq-конфигов"
|
||
@chmod +x scripts/generate-configs.sh
|
||
@./scripts/generate-configs.sh
|
||
|
||
deploy:
|
||
@echo "🚀 Деплой конфигов в систему"
|
||
@chmod +x scripts/deploy-to-gateway.sh
|
||
@./scripts/deploy-to-gateway.sh
|
||
|
||
# Прогрев nft-сетов. Запускать на шлюзе — читает задеплоенный конфиг и
|
||
# ходит в host-инстанс dnsmasq на 127.0.0.1:5350.
|
||
warm:
|
||
@echo "🔥 Прогрев nft-сетов"
|
||
@chmod +x scripts/warm-nftset.sh
|
||
@./scripts/warm-nftset.sh
|