From aed151b1a49727a0faff15f25aba14e90ccc7a43 Mon Sep 17 00:00:00 2001 From: Craig Jennings Date: Tue, 14 Jul 2026 00:23:16 -0500 Subject: feat(maint): ship a tailscale health-noise ignore list The maint probe now reads network.tailscale_health_ignore before grading the tailscale lamp. This ships the fleet default: tailscaled's permanent DNS-unreachable complaint under systemd-resolved, which kept the lamp amber while DNS worked. --- configs/maintenance-thresholds.toml | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'configs') diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml index c14eaec..340c66c 100644 --- a/configs/maintenance-thresholds.toml +++ b/configs/maintenance-thresholds.toml @@ -102,6 +102,13 @@ unclean_boot_sample = 10 # boots assessed for the rate [network] ntp_offset_warn_ms = 100 # chrony last-offset bound (typical is sub-ms) +# Tailscale health messages that are standing noise on this fleet (substring +# match). tailscaled can't read resolved's stub/DoT config, so its +# DNS-unreachable complaint fires permanently while DNS works — it kept the +# lamp amber on every machine. A real DNS outage still surfaces elsewhere +# (clock sync, the net-tier scans). Ignored messages stay visible in the +# metric's evidence as health_ignored. +tailscale_health_ignore = ["can't reach the configured DNS servers"] [backups] rsyncshot_daily_crit_hours = 48 # daily backup older than this is a fire -- cgit v1.2.3