An agent installed without token and enrolled with the command of the web
interface never ran as a service: the installer left the unit disabled and
the root-run enrollment left an identity the service user could not read.
The installer now always enables the agent unit (it waits for the
identity via ConditionPathExists), enroll as root hands the state over to
the service user and enables and starts the unit, and rerunning or
upgrading the installer repairs agents enrolled by hand. The web interface
shows the matching installer command next to the enroll command.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On the user's server the check reported "socket: permission denied" for
ping and asked only the server's own resolver. Ping now falls back to a
raw ICMP socket (the server unit gets CAP_NET_RAW, like /bin/ping); DNS
asks the DNS agents outside clusters when no name server addresses are
configured, gives every server its own timeout, and explains missing
records (dynamic zone, system resolver, not deployed yet).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
make packages (or make release PACKAGES=1) packages the binaries from the
release tarballs with the unit rendered for /usr/bin and the license
text, and rewrites SHA256SUMS over tarballs and packages. nfpm 2.48.0 is
installed pinned with checksum by scripts/ci/install-tools.sh, which can
now install single tools. Make targets lint-brand and sign-release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The development and end-to-end named.conf include the TSIG keys file, which starts empty, so named starts before the first revision.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- end-to-end OIDC test: discovery, PKCE (S256) verified by the IdP, nonce,
state cookie, ID token signature, user creation, role sync, refused
login without role, forged state
- make run-server / dev-admin with deploy/config/server.dev.yaml
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pattern meant for Go test binaries also matched db.dev.test, so BIND in
CI started without the forward zone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fixed 172.30.53.0/24 subnet collided with an existing network on the
CI runner's Docker host. Seed data now uses 192.0.2.0/24 (RFC 5737), served
by Kea via relay; host ports are configurable and random in CI, and each
CI run uses its own compose project.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bind mounts break when the Docker daemon does not share the job's
filesystem, as with containerised CI runners.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
BIND uses the production layout (single include under ddi-suite/).
Smoke test checks queries, zone validity, refused recursion and Kea config.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
sir_melonchenandClaude Opus 5.5
beug.k@beugsiud.deandClaude Opus 5.5