DNS check during deployment is not working with desec.io as upstream DNS(SEC) provider
- Dominant language
- Python
- Stars
- 484
- Forks
- 64
- Avg merge
- 4h 32m
- Merged PRs (30d)
- 11
Description
- Server OS (Operating System): `Debian 12.12`
- On which OS you run cmdeploy: `Manjaro Linux`
- chatmail/relay version: `87022e3681b4de62eac81ad1f5b5552ac24d3bec`
## Expected behavior
The DNS checks before deployment don't time out when the SOA is not answering (or there should be a fallback).
## Actual behavior
I get a timeout after 60s and the deployment script stops.
### Steps to reproduce the problem:
1. `cmdeploy run`
2. Wait for the following error message:
```
[ssh] login to mydomain.de
[ssh] Collecting initial DNS settings.
.........Traceback (most recent call last):
File "/home/user/relay/venv/bin/cmdeploy", line 6, in
sys.exit(main())
~~~~^^
File "/home/user/relay/cmdeploy/src/cmdeploy/cmdeploy.py", line 411, in main
res = args.func(args, out, **kwargs)
File "/home/user/relay/cmdeploy/src/cmdeploy/cmdeploy.py", line 95, in run_cmd
remote_data = dns.get_initial_remote_data(sshexec, args.config.mail_domain)
File "/home/user/relay/cmdeploy/src/cmdeploy/dns.py", line 10, in get_initial_remote_data
return sshexec.logged(
~~~~~~~~~~~~~~^
call=remote.rdns.perform_initial_checks, kwargs=dict(mail_domain=mail_domain)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/home/user/relay/cmdeploy/src/cmdeploy/sshexec.py", line 79, in logged
return self(call, kwargs, log_callback=print_stderr)
File "/home/user/relay/cmdeploy/src/cmdeploy/sshexec.py", line 65, in __call__
code, data = self._remote_cmdloop_channel.receive(timeout=self.timeout)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
File "/home/user/relay/venv/lib/python3.14/site-packages/execnet/gateway_base.py", line 931, in receive
raise self.TimeoutError("no item after %r seconds" % timeout) from None
execnet.gateway_base.TimeoutError: no item after 60 seconds
....
```
### What I already checked
- The DNS entries are in place
- No firewall is blocking the requests
- The "error" seems to be on desec.io server side (maybe this is expected behaviour by them)
### Logs
Executing the following two commands (which are executed by the deploy script on the remote host) I get the following results:
`dig -r -q mydomain.de -t SOA +noall +authority +answer`
```
mydomain.de. 42 IN SOA get.desec.io. get.desec.io. 2026024337 86400 3600 2419200 3600
```
`dig @get.desec.io. -r -q mydomain.de -t A +short`
```
;; communications error to 2a01:4f8:10a:1044:deec:642:ac10:80#53: timed out
;; communications error to 2a01:4f8:10a:1044:deec:642:ac10:80#53: timed out
;; communications error to 2a01:4f8:10a:1044:deec:642:ac10:80#53: timed out
1.2.3.4 <-- COMMENT: This is actually the right IP and I think it is resolved using IPv4 but I'm not sure
```
### Workaround
Deploying with `cmdeploy run --skip-dns-check` works, but I think the script should have a fallback to either use IPv4 then or provide an error message which tells people to use the `--skip-dns-check` parameter
Contributor guide
Assessment
This issue has not been assessed yet.