From 28e119cee229ad899460fe643c4e67e6a202796e Mon Sep 17 00:00:00 2001
From: Graham McIntire <graham@mcintire.me>
Date: Fri, 24 Jul 2026 11:17:33 -0500
Subject: [PATCH] fix(resolvers): disable systemd-resolved stub listener
 instead of masking

systemd-resolved must run for host DNS (nss/resolv.conf), but its stub
listener on 127.0.0.53:53 conflicts with Unbound's bind to 0.0.0.0:53.

Replace masking with DNSStubListener=no dropin + static resolv.conf
pointing to 1.1.1.1 and 9.9.9.9, so the host can resolve without
occupying port 53.
---
 tofu/flatcar-resolver.bu  | 15 +++++++++++++--
 tofu/flatcar-resolver2.bu | 15 +++++++++++++--
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/tofu/flatcar-resolver.bu b/tofu/flatcar-resolver.bu
index 42d463f..909e422 100644
--- a/tofu/flatcar-resolver.bu
+++ b/tofu/flatcar-resolver.bu
@@ -18,6 +18,13 @@ storage:
       overwrite: true
       contents:
         inline: flatcar-resolver1
+    - path: /etc/resolv.conf
+      mode: 0644
+      overwrite: true
+      contents:
+        inline: |
+          nameserver 1.1.1.1
+          nameserver 9.9.9.9
     - path: /etc/systemd/network/00-eth0.network
       mode: 0644
       contents:
@@ -30,8 +37,8 @@ storage:
           [Network]
           Address=204.110.191.240/26
           Gateway=204.110.191.254
-          DNS=9.9.9.9
           DNS=1.1.1.1
+          DNS=9.9.9.9
 
           [Address]
           Address=2606:1c80::240/64
@@ -112,7 +119,11 @@ storage:
 systemd:
   units:
     - name: systemd-resolved.service
-      mask: true
+      dropins:
+        - name: no-stub.conf
+          contents: |
+            [Resolve]
+            DNSStubListener=no
     - name: docker.service
       enabled: true
     - name: unbound.service
diff --git a/tofu/flatcar-resolver2.bu b/tofu/flatcar-resolver2.bu
index d8db45d..363f2e6 100644
--- a/tofu/flatcar-resolver2.bu
+++ b/tofu/flatcar-resolver2.bu
@@ -18,6 +18,13 @@ storage:
       overwrite: true
       contents:
         inline: flatcar-resolver2
+    - path: /etc/resolv.conf
+      mode: 0644
+      overwrite: true
+      contents:
+        inline: |
+          nameserver 1.1.1.1
+          nameserver 9.9.9.9
     - path: /etc/systemd/network/00-eth0.network
       mode: 0644
       contents:
@@ -30,8 +37,8 @@ storage:
           [Network]
           Address=204.110.191.250/26
           Gateway=204.110.191.254
-          DNS=9.9.9.9
           DNS=1.1.1.1
+          DNS=9.9.9.9
 
           [Address]
           Address=2606:1c80::250/64
@@ -112,7 +119,11 @@ storage:
 systemd:
   units:
     - name: systemd-resolved.service
-      mask: true
+      dropins:
+        - name: no-stub.conf
+          contents: |
+            [Resolve]
+            DNSStubListener=no
     - name: docker.service
       enabled: true
     - name: unbound.service