mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-12 20:30:53 +01:00
Krzysztof kuhy Rudnicki
143d260c1c
Measured on the Pixel 6a, twice: with private_dns_mode=hostname and the resolver unreachable, `ping example.com` returns "unknown host". Android's Private DNS does not fall back to the carrier's resolver -- hostname mode is RFC 8310's strict profile, and failing to establish TLS on 853 is a hard error. So a resolver living on this PC means "PC off" equals "phone has no internet", not merely "no filtering". That is disqualifying for a daily driver, and it disqualifies the whole home-hosted delivery path regardless of how well it works while the machine is up -- which it does; it was verified end to end. DNS_TRUSTED_DOT_HOST/IPS go back to empty, which restores the previous enforcer behaviour byte for byte. No code revert is needed, which is exactly why the flag was built to default empty. Two things found while testing are worth keeping. The nftables input chain is policy drop and admitted only ssh over wg0, so binding stunnel to the tunnel address was not sufficient on its own: ICMP passed while TCP 853 was dropped, which presents confusingly as "ping works but the port does not". That rule is now added explicitly and scoped to wg0. And setup_phone_wireguard.sh automates the client setup the tunnel needed, verifying handshake, reachability and DNS rather than assuming success, and deleting the pushed private key afterwards. The deeper reason the home endpoint could not work even with the tunnel up: dns.kuhy.duckdns.org resolves to the public IP while stunnel listens only on 10.8.0.1, and with AllowedIPs=10.8.0.0/24 that routes outside the tunnel to a closed port. Android never opened a connection at all. Split-horizon DNS does not fix it either, since on mobile data the phone uses the carrier's resolver. Research also ruled out the hosted-hybrid option that looked most attractive: no provider can ingest a 185k-domain list (NextDNS none, AdGuard 1-5K, ControlD 10K), and the free tiers fail OPEN -- they stop filtering past 300k queries a month while still resolving, which for a self-control tool is the worst failure mode available. Details and the remaining options are in the parked doc. The stunnel endpoint is left running deliberately: WireGuard-only, verified unreachable from LAN and WAN, and it makes the next attempt testable immediately. Removal commands are documented. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AwepyL5Lxs5QKbKkMpxxxL |
||
|---|---|---|
| .. | ||
| systemd | ||
| control_from_mobile.sh | ||
| install_unreal_mcp_kvick.sh | ||
| install_unreal_mcp.sh | ||
| keepass_consolidate.sh | ||
| keepass_sync.sh | ||
| keepass-open.sh | ||
| migrate_github_to_gitea.sh | ||
| raspberry_pi_flash_sd.sh | ||
| raspberry_pi_nextcloud.sh | ||
| setup_activitywatch.sh | ||
| setup_dns_blocker.sh | ||
| setup_dot_resolver.sh | ||
| setup_dwm.sh | ||
| setup_gitea.sh | ||
| setup_kcd2_dice_solver.sh | ||
| setup_keepass_sync.sh | ||
| setup_local_llm.sh | ||
| setup_nextcloud_raspberry.sh | ||
| setup_personal_website.sh | ||
| setup_phone_wireguard.sh | ||
| setup_syncyomi.sh | ||
| setup_wireguard_ssh.sh | ||