From a4f3d61c84b68c54ec62d6999e5cbc0c91fb9f91 Mon Sep 17 00:00:00 2001 From: canvas-bot Date: Mon, 15 Jun 2026 16:34:39 +0400 Subject: [PATCH] fix(nginx): add public DNS fallback for upstream resolution The in-cluster CoreDNS at 10.43.0.10 was returning empty for demo.flow-master.ai, causing every /api/* proxy_pass to fail with fast 502 (DNS resolution failure). Add 1.1.1.1 and 8.8.8.8 as fallbacks so nginx can resolve public hostnames even when CoreDNS doesn't forward external queries. Lazy per-request resolution via $variable form preserved. --- nginx.conf | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/nginx.conf b/nginx.conf index bac771e..0ad1684 100644 --- a/nginx.conf +++ b/nginx.conf @@ -19,11 +19,13 @@ server { add_header Cross-Origin-Resource-Policy "same-origin" always; add_header X-Robots-Tag "noindex, nofollow" always; - # Use the cluster CoreDNS resolver so upstream hostnames are resolved - # lazily (per-request), not at nginx startup. The proxy_pass targets below - # use $variable form to force this lazy resolution; otherwise nginx fails - # to start when cluster DNS is briefly unavailable (e.g. node recovery). - resolver 10.43.0.10 valid=30s ipv6=off; + # Use the cluster CoreDNS resolver for in-cluster Services AND public + # resolvers as fallback for external hostnames (demo.flow-master.ai etc.). + # k3s CoreDNS by default forwards external lookups, but if the forward + # is missing the proxy_pass to demo.flow-master.ai fails with 502/504. + # Listing public resolvers alongside ensures lookups succeed in both + # cases. Targets use $variable form to force lazy per-request resolution. + resolver 10.43.0.10 1.1.1.1 8.8.8.8 valid=30s ipv6=off; # Reverse-proxy /api to the demo backend so live mode is same-origin. location /api/ {