114 lines
3.4 KiB
Markdown
114 lines
3.4 KiB
Markdown
# sys-fips `.fips` Browser Access Remediation Plan
|
||
|
||
## Goal
|
||
|
||
Make `.fips` hostnames (especially the npub hostname for `laantungir.net`) resolve and load from the current AppVM browser path.
|
||
|
||
## Confirmed Root Cause
|
||
|
||
Current AppVM DNS path is returning public-DNS NXDOMAIN for `.fips`, which means `.fips` forwarding via `sys-fips` is not active in the effective network chain.
|
||
|
||
## Success Criteria
|
||
|
||
1. From AppVM, the npub `.fips` hostname returns an AAAA answer (not NXDOMAIN).
|
||
2. Browser can open the npub `.fips` URL successfully.
|
||
3. `sys-fips` is persistently configured so the behavior survives reboot.
|
||
|
||
---
|
||
|
||
## Phase 1 — Validate and fix the network chain in dom0
|
||
|
||
1. Ensure target AppVM uses `sys-fips` as netvm (not `sys-firewall`/`sys-whonix`/other).
|
||
2. Ensure `sys-fips` itself chains to intended upstream netvm (`sys-firewall` or `sys-vpn`).
|
||
3. Restart affected VMs after netvm changes so DHCP/DNS lease state is refreshed.
|
||
|
||
Reference workflow: [`README.md`](README.md:102)
|
||
|
||
---
|
||
|
||
## Phase 2 — Bring `sys-fips` services to healthy state
|
||
|
||
Inside `sys-fips`:
|
||
|
||
1. Start/enable FIPS services (`fips`, `fips-dns`).
|
||
2. Ensure FIPS config has DNS enabled on local resolver port 5354.
|
||
3. Ensure `fips0` exists and has IPv6 address.
|
||
|
||
Config reference: [`configs/fips.yaml`](configs/fips.yaml:6)
|
||
|
||
---
|
||
|
||
## Phase 3 — Re-apply DNS forwarding in `sys-fips`
|
||
|
||
Inside `sys-fips`:
|
||
|
||
1. Run DNS setup script to make dnsmasq forward `.fips` to local FIPS DNS (`127.0.0.1:5354`).
|
||
2. Verify dnsmasq is running and listening on port 53.
|
||
3. Verify local forwarding behavior using a `.fips` query.
|
||
|
||
Implementation reference: [`scripts/06-configure-dns.sh`](scripts/06-configure-dns.sh:1)
|
||
|
||
---
|
||
|
||
## Phase 4 — Re-apply IPv6 forwarding/routing for AppVM traffic
|
||
|
||
Inside `sys-fips`:
|
||
|
||
1. Enable IPv6 forwarding.
|
||
2. Ensure route for `fd00::/8` points to `fips0`.
|
||
3. Ensure ip6tables forwarding rules exist and are persisted.
|
||
|
||
Implementation reference: [`scripts/07-route-appvms.sh`](scripts/07-route-appvms.sh:1)
|
||
|
||
---
|
||
|
||
## Phase 5 — Verify mesh reachability from `sys-fips`
|
||
|
||
Inside `sys-fips`:
|
||
|
||
1. Confirm at least one reachable peer in FIPS config.
|
||
2. Confirm FIPS node has joined mesh and can resolve npub `.fips` locally.
|
||
3. If unresolved, add/bootstrap peers and restart FIPS.
|
||
|
||
Planning reference: [`plans/sys-fips-plan.md`](plans/sys-fips-plan.md:143)
|
||
|
||
---
|
||
|
||
## Phase 6 — Verify from AppVM (the failing client)
|
||
|
||
From the AppVM:
|
||
|
||
1. Confirm resolver points to `sys-fips`-provided DNS.
|
||
2. Query npub `.fips` against current resolver and confirm AAAA response.
|
||
3. Confirm no NXDOMAIN for `.fips`.
|
||
|
||
If still NXDOMAIN, restart AppVM networking context (or reboot AppVM) after Phase 1–4 changes.
|
||
|
||
---
|
||
|
||
## Phase 7 — Browser validation (headed)
|
||
|
||
1. Test npub `.fips` URL in headed browser automation.
|
||
2. Test alias hostname variant (if configured in hosts mapping).
|
||
3. Capture browser errors; expected fix is removal of name-resolution failure.
|
||
|
||
Operational context from previous troubleshooting: [`plans/laantungir-tor-fips-plan.md`](plans/laantungir-tor-fips-plan.md:95)
|
||
|
||
---
|
||
|
||
## Execution Order (Minimal Downtime)
|
||
|
||
1. dom0 netvm chain correction
|
||
2. `sys-fips` service health (`fips`, `fips-dns`)
|
||
3. DNS forwarding script
|
||
4. Routing script
|
||
5. Peer/mesh verification
|
||
6. AppVM DNS verification
|
||
7. Browser verification
|
||
|
||
---
|
||
|
||
## Expected Outcome
|
||
|
||
After these steps, the AppVM should resolve the npub `.fips` hostname through `sys-fips` DNS forwarding and reach the remote FIPS-hosted site in browser without `ERR_NAME_NOT_RESOLVED`.
|