shad/canvas-frontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(nginx): drop CoreDNS from resolver, use public DNS only
build-and-publish / test (push) Has been cancelled
Details
build-and-publish / image (push) Has been cancelled
Details

Browse Source 
CoreDNS at 10.43.0.10 returns SERVFAIL for demo.flow-master.ai in
this environment. Including it in the resolver list caused nginx
to query it first, get SERVFAIL, and return 502 before falling
back to 1.1.1.1. Pinning to public resolvers eliminates the cold
miss. 300s TTL caches the result.

Restored $variable form for proxy_pass because the static-hostname
form failed pod readiness (DNS query at config-load time hits
the same SERVFAIL).
This commit is contained in:
canvas-bot
2026-06-15 18:56:29 +04:00
parent db32934100
commit 722b0ba3a2
1 changed files with 13 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx.conf
+13 -14
View File
@@ -19,23 +19,22 @@ server {
add_header Cross-Origin-Resource-Policy "same-origin" always;
add_header X-Robots-Tag "noindex, nofollow" always;
# Use the cluster CoreDNS resolver for in-cluster Services AND public
# resolvers as fallback for external hostnames (demo.flow-master.ai etc.).
# k3s CoreDNS by default forwards external lookups, but if the forward
# is missing the proxy_pass to demo.flow-master.ai fails with 502/504.
# Listing public resolvers alongside ensures lookups succeed in both
# cases. Targets use $variable form to force lazy per-request resolution.
resolver 10.43.0.10 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
# Use PUBLIC DNS resolvers exclusively for upstream resolution. The
# k3s CoreDNS at 10.43.0.10 returns SERVFAIL for external hostnames
# like demo.flow-master.ai in this environment, which previously
# caused intermittent 502s when nginx queried CoreDNS first. Pinning
# to Cloudflare + Google means demo.flow-master.ai resolves the same
# way it does from the public internet.
resolver 1.1.1.1 8.8.8.8 valid=300s ipv6=off;
# Reverse-proxy /api to the demo backend so live mode is same-origin.
# NOTE: proxy_pass uses a literal hostname (not a $variable) so nginx
# resolves demo.flow-master.ai ONCE at config-load, caches it for the
# lifetime of the worker, and never retries DNS mid-request. This is
# the only way to eliminate the per-request DNS race that returned
# fast 502s on cold cache. Cloudflare hides the demo origin behind
# anycast IPs, so a single-resolution lookup is safe and stable.
# Uses $variable form so nginx queries the PUBLIC resolver above per
# request (cached 5 minutes). Combined with proxy_next_upstream this
# tolerates a transient upstream failure with a single client-visible
# latency penalty.
location /api/ {
proxy_pass https://demo.flow-master.ai;
set $upstream_demo "https://demo.flow-master.ai";
proxy_pass $upstream_demo;
proxy_set_header Host demo.flow-master.ai;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Forwarded-Host $host;