nearxos
0375b20bb4
- Added configuration options for requiring human approval before applying LLM-generated MCP patches. - Updated Docker setup to include skills directory. - Integrated skills management into the backend, allowing for procedural guides and skill matching. - Refactored database initialization to apply Alembic migrations. - Enhanced task approval process to handle MCP patch applications with optional approval. - Introduced new schemas for skills and updated existing APIs to support skills functionality. This commit lays the groundwork for improved agent capabilities and better management of MCP development processes.
82 lines
2.7 KiB
Markdown
82 lines
2.7 KiB
Markdown
---
|
|
id: vessel-dns-portal
|
|
name: Vessel DNS and captive portal
|
|
description: >-
|
|
Crew/business DNS slowness, ship-dns upstream timeouts, captive portal auth,
|
|
RADIUS, and hairpin portal access on GeneseasX stacks.
|
|
priority: 85
|
|
rule_ids:
|
|
- crew-dns-slow
|
|
- dns-captive-portal
|
|
match:
|
|
keywords:
|
|
- dns
|
|
- slow dns
|
|
- ship-dns
|
|
- captive
|
|
- portal
|
|
- crew
|
|
- radius
|
|
- coovachilli
|
|
- login
|
|
- internet
|
|
- redirect
|
|
- resolver
|
|
---
|
|
|
|
# Vessel DNS and captive portal
|
|
|
|
## Architecture (typical GeneseasX)
|
|
|
|
- **pfSense** is the DNS gateway for crew/business — redirects UDP/53 per segment.
|
|
- **Do NOT** hand crew/business the Docker VM IP (`10.20.30.222`) as DNS directly.
|
|
- **ship-dns** container on Docker VM resolves upstream; misconfigured primary = multi-second delays.
|
|
- **Captive portal** on CREW VLAN: pfSense CP + RADIUS back to Docker stack.
|
|
|
|
## Crew DNS slow (`ship-dns`)
|
|
|
|
**Known root cause:** primary upstream unreachable from Docker VM → every query waits full timeout before fallback.
|
|
|
|
| Symptom | Likely cause |
|
|
|---------|--------------|
|
|
| ~3s per lookup | Primary (e.g. `1.1.1.1`) blocked; fallback works after timeout |
|
|
| Fast after fix | Primary `8.8.8.8`, secondary `9.9.9.9`, `dns_timeout=2` |
|
|
|
|
**Investigation order:**
|
|
|
|
1. Docker VM: `docker ps` — ship-dns container healthy
|
|
2. Docker VM: time lookups per upstream (`dig @1.1.1.1`, `@8.8.8.8`, `@9.9.9.9`)
|
|
3. ship-dns config: primary/secondary/timeout, worker concurrency
|
|
4. pfSense: crew/business DNS redirect points at pfSense, not Docker IP
|
|
|
|
**Persistence warning:** in-place edits inside ship-dns container **revert on image recreate**. Fixes belong in the image/build, not only `docker cp`.
|
|
|
|
## Captive portal / crew internet
|
|
|
|
**Flow:** crew device → pfSense captive portal → RADIUS auth → Docker RADIUS/portal containers.
|
|
|
|
| Symptom | Check |
|
|
|---------|-------|
|
|
| Portal page won't load | Hairpin / NAT reflection: crew → pfSense:443 → Docker portal |
|
|
| Auth fails | RADIUS reachability (auth/acct ports) to Docker stack |
|
|
| Authenticated but no service | Missing pass rules on CREW for new services (e.g. VoIP added later) |
|
|
|
|
**Investigation order:**
|
|
|
|
1. pfSense: captive portal zone status, CREW floating + interface rules
|
|
2. pfSense: 443 portal redirect, NAT reflection, RADIUS pass rules to Docker
|
|
3. Docker VM: portal + RADIUS container health and logs on failed auth
|
|
|
|
## pfSense interface roles (confirm live)
|
|
|
|
- CREW (`vtnet2`): isolated, captive portal, floating rules
|
|
- Business (`vtnet3`): restrictive pass (DNS/HTTPS/SIP)
|
|
- Management (`vtnet4`): usually permissive
|
|
|
|
## Evidence to capture
|
|
|
|
- Per-upstream DNS timing from Docker VM
|
|
- ship-dns effective resolver settings
|
|
- pfSense CP + RADIUS rule list
|
|
- Portal/RADIUS container logs for failed login attempts
|