By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Summary
On distributions whose /etc/nsswitch.conf hosts line consults resolve ahead of dns with [!UNAVAIL=return] (Arch Linux default, among others), writing /etc/resolv.conf via NetworkManager or resolvconf has no effect on hostname resolution — NSS asks systemd-resolved first, resolved has no DNS for the tunnel interface, and the action clause halts fallthrough to the dns service. Tunnel-only hostnames silently return NXDOMAIN.
DetectDNSManager now checks the NSS hosts line and, when resolved dominates, returns SystemdResolvedManager so the existing D-Bus-based SystemdResolvedDNSConfigurator takes over (it already calls SetDNS / SetDomains(".", MatchOnly:true) / SetDefaultRoute(true), which is what's needed here).
Full reproduction, symptoms, and root-cause analysis are in #114.
Changes
dns/platform/detect_unix.go:
Add nsswitchPrefersResolved() that parses /etc/nsswitch.conf's hosts line and returns true when resolve precedes dns or dns is absent (ignoring action clauses like [!UNAVAIL=return]).
In DetectDNSManager, consult it in the NetworkManagerManager and ResolvconfManager branches. When systemd-resolved is running and NSS routes through it, return SystemdResolvedManager.
dns/platform/detect_unix_test.go: table-driven tests for nsswitchPrefersResolved covering the Arch default line, resolve-only, dns-only, reversed order, commented lines, indented lines, and missing file.
No new dependencies; no public API change.
Test plan
go build ./...
go vet ./...
go test ./dns/platform/... (8 subtests for nsswitchPrefersResolved, all pass)
On-device: confirmed on Arch Linux that running resolvectl dns <iface> 100.96.128.1 + resolvectl domain <iface> '~<internal>' restores resolution — i.e. the path this PR takes automatically
Maintainer sanity-check on Debian/Ubuntu (classic hosts: files dns) and Fedora (systemd-resolved primary) to confirm no regression in the non-Arch cases
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/fosrl/olm/pull/115
**Author:** [@andusystems-dev-0](https://github.com/andusystems-dev-0)
**Created:** 4/21/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `fix/nsswitch-prefer-resolved`
---
### 📝 Commits (1)
- [`c85dbf6`](https://github.com/fosrl/olm/commit/c85dbf66761163a9297c50786dd1125397c9af1e) dns/platform: prefer systemd-resolved when NSS routes through it
### 📊 Changes
**2 files changed** (+171 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `dns/platform/detect_unix.go` (+85 -1)
➕ `dns/platform/detect_unix_test.go` (+86 -0)
</details>
### 📄 Description
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
## Summary
- On distributions whose `/etc/nsswitch.conf` hosts line consults `resolve` ahead of `dns` with `[!UNAVAIL=return]` (Arch Linux default, among others), writing `/etc/resolv.conf` via NetworkManager or resolvconf has no effect on hostname resolution — NSS asks systemd-resolved first, resolved has no DNS for the tunnel interface, and the action clause halts fallthrough to the `dns` service. Tunnel-only hostnames silently return NXDOMAIN.
- `DetectDNSManager` now checks the NSS hosts line and, when resolved dominates, returns `SystemdResolvedManager` so the existing D-Bus-based `SystemdResolvedDNSConfigurator` takes over (it already calls `SetDNS` / `SetDomains(".", MatchOnly:true)` / `SetDefaultRoute(true)`, which is what's needed here).
Full reproduction, symptoms, and root-cause analysis are in #114.
## Changes
- `dns/platform/detect_unix.go`:
- Add `nsswitchPrefersResolved()` that parses `/etc/nsswitch.conf`'s hosts line and returns true when `resolve` precedes `dns` or `dns` is absent (ignoring action clauses like `[!UNAVAIL=return]`).
- In `DetectDNSManager`, consult it in the `NetworkManagerManager` and `ResolvconfManager` branches. When systemd-resolved is running **and** NSS routes through it, return `SystemdResolvedManager`.
- `dns/platform/detect_unix_test.go`: table-driven tests for `nsswitchPrefersResolved` covering the Arch default line, resolve-only, dns-only, reversed order, commented lines, indented lines, and missing file.
No new dependencies; no public API change.
## Test plan
- [x] `go build ./...`
- [x] `go vet ./...`
- [x] `go test ./dns/platform/...` (8 subtests for `nsswitchPrefersResolved`, all pass)
- [x] On-device: confirmed on Arch Linux that running `resolvectl dns <iface> 100.96.128.1` + `resolvectl domain <iface> '~<internal>'` restores resolution — i.e. the path this PR takes automatically
- [ ] Maintainer sanity-check on Debian/Ubuntu (classic `hosts: files dns`) and Fedora (systemd-resolved primary) to confirm no regression in the non-Arch cases
Closes #114
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/fosrl/olm/pull/115
Author: @andusystems-dev-0
Created: 4/21/2026
Status: ❌ Closed
Base:
main← Head:fix/nsswitch-prefer-resolved📝 Commits (1)
c85dbf6dns/platform: prefer systemd-resolved when NSS routes through it📊 Changes
2 files changed (+171 additions, -1 deletions)
View changed files
📝
dns/platform/detect_unix.go(+85 -1)➕
dns/platform/detect_unix_test.go(+86 -0)📄 Description
By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.
Summary
/etc/nsswitch.confhosts line consultsresolveahead ofdnswith[!UNAVAIL=return](Arch Linux default, among others), writing/etc/resolv.confvia NetworkManager or resolvconf has no effect on hostname resolution — NSS asks systemd-resolved first, resolved has no DNS for the tunnel interface, and the action clause halts fallthrough to thednsservice. Tunnel-only hostnames silently return NXDOMAIN.DetectDNSManagernow checks the NSS hosts line and, when resolved dominates, returnsSystemdResolvedManagerso the existing D-Bus-basedSystemdResolvedDNSConfiguratortakes over (it already callsSetDNS/SetDomains(".", MatchOnly:true)/SetDefaultRoute(true), which is what's needed here).Full reproduction, symptoms, and root-cause analysis are in #114.
Changes
dns/platform/detect_unix.go:nsswitchPrefersResolved()that parses/etc/nsswitch.conf's hosts line and returns true whenresolveprecedesdnsordnsis absent (ignoring action clauses like[!UNAVAIL=return]).DetectDNSManager, consult it in theNetworkManagerManagerandResolvconfManagerbranches. When systemd-resolved is running and NSS routes through it, returnSystemdResolvedManager.dns/platform/detect_unix_test.go: table-driven tests fornsswitchPrefersResolvedcovering the Arch default line, resolve-only, dns-only, reversed order, commented lines, indented lines, and missing file.No new dependencies; no public API change.
Test plan
go build ./...go vet ./...go test ./dns/platform/...(8 subtests fornsswitchPrefersResolved, all pass)resolvectl dns <iface> 100.96.128.1+resolvectl domain <iface> '~<internal>'restores resolution — i.e. the path this PR takes automaticallyhosts: files dns) and Fedora (systemd-resolved primary) to confirm no regression in the non-Arch casesCloses #114
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.