laantungir/fips_setup
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
master
fips_setup/plans/sys-fips-browser-fix-plan.md
Laan Tungir a09c87ef10 Hammered fips bugs
2026-04-11 20:40:01 -04:00

3.4 KiB
Raw Permalink Blame History

sys-fips .fips Browser Access Remediation Plan

Goal

Make .fips hostnames (especially the npub hostname for laantungir.net) resolve and load from the current AppVM browser path.

Confirmed Root Cause

Current AppVM DNS path is returning public-DNS NXDOMAIN for .fips, which means .fips forwarding via sys-fips is not active in the effective network chain.

Success Criteria

  1. From AppVM, the npub .fips hostname returns an AAAA answer (not NXDOMAIN).
  2. Browser can open the npub .fips URL successfully.
  3. sys-fips is persistently configured so the behavior survives reboot.

Phase 1 — Validate and fix the network chain in dom0

  1. Ensure target AppVM uses sys-fips as netvm (not sys-firewall/sys-whonix/other).
  2. Ensure sys-fips itself chains to intended upstream netvm (sys-firewall or sys-vpn).
  3. Restart affected VMs after netvm changes so DHCP/DNS lease state is refreshed.

Reference workflow: README.md

Phase 2 — Bring sys-fips services to healthy state

Inside sys-fips:

  1. Start/enable FIPS services (fips, fips-dns).
  2. Ensure FIPS config has DNS enabled on local resolver port 5354.
  3. Ensure fips0 exists and has IPv6 address.

Config reference: configs/fips.yaml

Phase 3 — Re-apply DNS forwarding in sys-fips

Inside sys-fips:

  1. Run DNS setup script to make dnsmasq forward .fips to local FIPS DNS (127.0.0.1:5354).
  2. Verify dnsmasq is running and listening on port 53.
  3. Verify local forwarding behavior using a .fips query.

Implementation reference: scripts/06-configure-dns.sh

Phase 4 — Re-apply IPv6 forwarding/routing for AppVM traffic

Inside sys-fips:

  1. Enable IPv6 forwarding.
  2. Ensure route for fd00::/8 points to fips0.
  3. Ensure ip6tables forwarding rules exist and are persisted.

Implementation reference: scripts/07-route-appvms.sh

Phase 5 — Verify mesh reachability from sys-fips

Inside sys-fips:

  1. Confirm at least one reachable peer in FIPS config.
  2. Confirm FIPS node has joined mesh and can resolve npub .fips locally.
  3. If unresolved, add/bootstrap peers and restart FIPS.

Planning reference: plans/sys-fips-plan.md

Phase 6 — Verify from AppVM (the failing client)

From the AppVM:

  1. Confirm resolver points to sys-fips-provided DNS.
  2. Query npub .fips against current resolver and confirm AAAA response.
  3. Confirm no NXDOMAIN for .fips.

If still NXDOMAIN, restart AppVM networking context (or reboot AppVM) after Phase 1–4 changes.

Phase 7 — Browser validation (headed)

  1. Test npub .fips URL in headed browser automation.
  2. Test alias hostname variant (if configured in hosts mapping).
  3. Capture browser errors; expected fix is removal of name-resolution failure.

Operational context from previous troubleshooting: plans/laantungir-tor-fips-plan.md

Execution Order (Minimal Downtime)

  1. dom0 netvm chain correction
  2. sys-fips service health (fips, fips-dns)
  3. DNS forwarding script
  4. Routing script
  5. Peer/mesh verification
  6. AppVM DNS verification
  7. Browser verification

Expected Outcome

After these steps, the AppVM should resolve the npub .fips hostname through sys-fips DNS forwarding and reach the remote FIPS-hosted site in browser without ERR_NAME_NOT_RESOLVED.