Bug 2338429

Summary:	After=network-online.target is not usable in initram image
Product:	[Fedora] Fedora	Reporter:	Petr Menšík <pemensik>
Component:	unbound	Assignee:	Petr Menšík <pemensik>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	paul.wouters, pemensik, pj.pandit
Target Milestone:	---	Keywords:	Regression
Target Release:	---	Flags:	pemensik: mirror+
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	unbound-1.22.0-9.fc42	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-01-20 14:58:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Petr Menšík 2025-01-16 14:13:15 UTC

As part of DNS over TLS enabling for RHEL, we have discovered unbound starts After=network-online.target. That is not desired in the default configuration, where it listens only on localhost.

Unbound has to start Before=nss-lookup.target, effectively it may provide basic name resolution for the system. At least we want it with dnsconfd that way.

Because of integration with Network Manager, we may enter deadlock from NM. It wants to set network-online.target only after DNS were successfully configured. Therefore it has to start only After=network.target, because network-online.target may depend on unbound.service activated. Therefore we cannot wait for it.

Reproducible: Always

Steps to Reproduce:
1. systemctl enable unbound.service
2. change unbound.service to have only After=network.target
3. reboot
4. verify it started correctly
Actual Results:  
It starts only after network-online.target is reached

Expected Results:  
It starts before network-online.target is reached

Changed by commit https://src.fedoraproject.org/forks/pemensik/rpms/unbound/c/2b640c85f833618e67f3b412d3a5b88f4518c34b.

This needs to be reverted back.

Comment 1 Petr Menšík 2025-01-16 14:43:29 UTC

After specific IP address is used in interface: or similar configuration, it might be required to change it After=network-online.target.

That could be done for example command:

systemctl edit unbound.service

Then in the editor, type the following:

[Unit]
After=network-online.target

#before
### Edits below this comment will be discarded

That would make additional change to default unbound.service, making it start later.

Maybe even more preferred way would be setting ip-freebind: yes in server: section. That allows binding to addresses not yet present on the system. It should be used as soon as that address becomes present on the system.
Disadvantage is it won't watch for typos of your addresses. If you listen on address never appearing, it won't tell you the address is wrong.

Comment 2 Fedora Update System 2025-01-16 18:27:25 UTC

FEDORA-2025-0504e17592 (unbound-1.22.0-9.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-0504e17592

Comment 3 Fedora Update System 2025-01-20 14:58:58 UTC

FEDORA-2025-0504e17592 (unbound-1.22.0-9.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.