shad/canvas-frontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(nginx): drop CoreDNS from resolver, use public DNS only
build-and-publish / test (push) Has been cancelled
Details
build-and-publish / image (push) Has been cancelled
Details

Browse Source 
CoreDNS at 10.43.0.10 returns SERVFAIL for demo.flow-master.ai in
this environment. Including it in the resolver list caused nginx
to query it first, get SERVFAIL, and return 502 before falling
back to 1.1.1.1. Pinning to public resolvers eliminates the cold
miss. 300s TTL caches the result.

Restored $variable form for proxy_pass because the static-hostname
form failed pod readiness (DNS query at config-load time hits
the same SERVFAIL).
This commit is contained in:
canvas-bot
2026-06-15 18:56:29 +04:00
parent db32934100
commit 722b0ba3a2
1 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx.conf
+13 -14
View File
@@ -19,23 +19,22 @@ server {
add_header Cross-Origin-Resource-Policy "same-origin" always; add_header Cross-Origin-Resource-Policy "same-origin" always;
add_header X-Robots-Tag "noindex, nofollow" always; add_header X-Robots-Tag "noindex, nofollow" always;
# Use the cluster CoreDNS resolver for in-cluster Services AND public # Use PUBLIC DNS resolvers exclusively for upstream resolution. The
# resolvers as fallback for external hostnames (demo.flow-master.ai etc.). # k3s CoreDNS at 10.43.0.10 returns SERVFAIL for external hostnames
# k3s CoreDNS by default forwards external lookups, but if the forward # like demo.flow-master.ai in this environment, which previously
# is missing the proxy_pass to demo.flow-master.ai fails with 502/504. # caused intermittent 502s when nginx queried CoreDNS first. Pinning
# Listing public resolvers alongside ensures lookups succeed in both # to Cloudflare + Google means demo.flow-master.ai resolves the same
# cases. Targets use $variable form to force lazy per-request resolution. # way it does from the public internet.
resolver 10.43.0.10 1.1.1.1 8.8.8.8 valid=30s ipv6=off; resolver 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
# Reverse-proxy /api to the demo backend so live mode is same-origin. # Reverse-proxy /api to the demo backend so live mode is same-origin.
# NOTE: proxy_pass uses a literal hostname (not a $variable) so nginx # Uses $variable form so nginx queries the PUBLIC resolver above per
# resolves demo.flow-master.ai ONCE at config-load, caches it for the # request (cached 5 minutes). Combined with proxy_next_upstream this
# lifetime of the worker, and never retries DNS mid-request. This is # tolerates a transient upstream failure with a single client-visible
# the only way to eliminate the per-request DNS race that returned # latency penalty.
# fast 502s on cold cache. Cloudflare hides the demo origin behind
# anycast IPs, so a single-resolution lookup is safe and stable.
location /api/ { location /api/ {
proxy_pass https://demo.flow-master.ai; set $upstream_demo "https://demo.flow-master.ai";
proxy_pass $upstream_demo;
proxy_set_header Host demo.flow-master.ai; proxy_set_header Host demo.flow-master.ai;
proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Host $host;