When used with systemd-networkd, unbound does not start until systemd-networkd-wait-online.service times out #773
Comments
|
There seems to be a loop in the service file, in that the Wants seems to reference the stuff in the Before, for network-online and also for nss-lookup target. Perhaps the sensible approach would be to fill in the supposed answers here, unbound starts when the network target is done, and this is completed before the network-online target is reached. And also before nss-lookup, to have unbound up before nss-lookup intends to do queries. This sort of depends on the meaning of the targets and also other systemd set up. Perhaps this change could be good? diff --git a/contrib/unbound.service.in b/contrib/unbound.service.in
index ada5fac9..5a05c525 100644
--- a/contrib/unbound.service.in
+++ b/contrib/unbound.service.in
@@ -42,9 +42,8 @@
[Unit]
Description=Validating, recursive, and caching DNS resolver
Documentation=man:unbound(8)
-After=network-online.target
-Before=nss-lookup.target
-Wants=network-online.target nss-lookup.target
+After=network.target
+Before=network-online.target nss-lookup.target
[Install]
WantedBy=multi-user.target |
|
I can confirm that this works for me on two machines (one using systemd-networkd and one with no network manager, just iwd) - unbound is up and running in three seconds! (I attempted something similar on my own, but I realize now it failed because the standard |
|
That fixed it for me as well! |
|
The fix is committed to the repo. That should improve the systemd integration scripts for Unbound! |
* nlnet/master: - Updates for NLnetLabs#461 (Add max-query-restarts option). - Expose 'max-sent-count' as a configuration option; the default value retains Unbound's behavior. - Expose 'statistics-inhibit-zero' as a configuration option; the default value retains Unbound's behavior. - Fix to wrap Makefile scripts directory in quotes for uninstall. Changelog note for NLnetLabs#808 - Merge NLnetLabs#808: Wrap Makefile script's directory variables in quotes. wrap directory variables in quotes Fix date. - Fix NLnetLabs#773: When used with systemd-networkd, unbound does not start until systemd-networkd-wait-online.service times out. - Clear documentation for interactivity between the subnet module and the serve-expired and prefetch configuration options. - Add SVCB and HTTPS to the types removed by 'unbound-control flush'. - Fix NLnetLabs#782: Segmentation fault in stats.c:404. Changelog entry for NLnetLabs#720 Document max-query-restarts option Use max-query-restarts in iterative resolver Add max-query-restarts to grammar and lexer Add max-query-restarts config parameter
|
Maybe it's something related to this commit that when I restart the server the unbound service fails because the ipv6 network still hasn't come up. unbound[364]: [1673554420] unbound[364:0] error: can't bind socket: Cannot assign requested address for 2001:db8:0:2::2 port 53 I need to restart de service to bring it up: /etc/systemd/network/ens18.network [Address] [Address] [Network] |
|
Hi @wcawijngaards, I've encountered an issue where the Unbound service fails to restart on boot, which may be related to the issue you've addressed. TL;DR: After=network.target doesn't guarantee that interfaces are ready when Unbound attempts to bind to them. Changing the configuration to Details: Before I changed the unit file ( After I changed the unit file ( According to RHEL's documentation, network.target means that the service for setting up the network has started but doesn't guarantee that it's ready. In contrast, In most cases, the current setting works because interfaces are up faster than Unbound tries to bind to them. However, there's a chance that interfaces become slow, causing Unbound not to start at boot time. Many users modify their own systemd unit file to fix this (it's more likely to happen with custom interfaces). Changing |
|
Not facing the problem for ipv4. |
network-online.target. Also for contrib/unbound_portable.service.in.
|
The commit d43760a adds the |
NLnetLabs/unbound#773 Should address unbound failing to start because of network interface online ordering.
Describe the bug
As described in this arch linux bug report, "unbound waits for the network to be on (as stipulated in its service file) and systemd waits for the DNS resolver to be up before declaring that the network is on. The cycle only breaks when systemd network initialization times out and finally the unbound service file is allowed to start." The behavior started to occur with commit afbc7bb . Unbound and the network still work perfectly fine afterwards, it's just that DNS resolution doesn't come up until after the timeout period for systemd's network target.
To reproduce
On arch linux enable the systemd-networkd and unbound systemd services. Systemd-resolved is disabled. I don't believe it's relevant but I included a minimal resolvconf config file too.
Some more information on what's happening via systemd logs:
Output from
❯ systemctl status systemd-networkd-wait-online.service:And you can see via
journalctl --bootunbound only begins afterwards:System:
OS: Linux arch 6.0.5-arch1-1 #1 SMP PREEMPT_DYNAMIC Wed, 26 Oct 2022 15:25:45 +0000 x86_64 GNU/Linuxunbound -Voutput:The text was updated successfully, but these errors were encountered: