linuxmuster-release-upgrade: fix networkd-wait-online typo, stop masking systemd-resolved wholesale

[HappyBasher]

Description

Reported by a customer on the beta forum:
https://ask.linuxmuster.net/t/beta-test-linuxmuster-net-7-4/12176/212

sbin/linuxmuster-release-upgrade's "disable obsolete services" step
(lines ~163-169) had two problems:

1. networkd-wait-online.service isn't a real unit name on Ubuntu
   26.04 - the actual unit is systemd-networkd-wait-online.service.
   systemctl mask networkd-wait-online.service silently created a mask
   for a phantom unit; the real
   systemd-networkd-wait-online.service was never touched. Same class
   of typo as systemd-resolvd vs systemd-resolved, already fixed once
   before in f62a7db (Jan 2025).

2. Blanket-masking systemd-resolved and
   systemd-networkd-wait-online.service deviates from Ubuntu's standard
   service setup and risks breaking other units that still expect
   network-online.target or systemd-resolved's NSS/D-Bus interface to
   work.

The concrete symptom reported: systemd-resolved's DNS stub listener
binds 127.0.0.1:53 by default, conflicting with samba-ad-dc's own
internal DNS server trying to bind 0.0.0.0:53:

Failed to listen on 0.0.0.0:53 - NT_STATUS_ADDRESS_ALREADY_ASSOCIATED

Fix

Fixed by f504317 (branch 7.3):

• systemd-networkd-wait-online.service is no longer touched at all.
• systemd-resolved stays enabled; only its DNS stub listener is
  disabled via /etc/systemd/resolved.conf.d/no-stub.conf
  (DNSStubListener=no) - the actual, narrower cause of the port
  conflict. /etc/resolv.conf itself is unaffected either way, since
  it's already backed up/restored around this whole block regardless of
  what happens to systemd-resolved.
• isc-dhcp-server6 keeps being masked (genuinely obsolete, unrelated to
  this).

Follow-up

A separate, idempotent repair step for hosts that already completed the
upgrade under the old (masking) code is planned for the 7.4.20 release's
postinst script (unmask + re-enable + apply the same drop-in), so
already-upgraded systems self-heal on their next package update without
needing to re-run the whole release-upgrade script.

🤖 Generated with Claude Code

[HappyBasher]

Update: reverted the DNSStubListener=no approach after
Jesko's follow-up
in the same thread. With systemd-resolved merely stub-disabled but still
running, Ubuntu's default nsswitch.conf still queries it first via
nss-resolve/D-Bus for hostname lookups, using whatever DNS servers
netplan/networkd handed it - not necessarily what /etc/resolv.conf points
to. On a Samba AD domain controller that risks silently bypassing Samba's
own DNS or a resolution loop.

Fixed by be8a9ad instead: systemd-resolved keeps being masked outright
(the already-established, now re-validated approach), and only
systemd-networkd-wait-online.service is dropped from the mask loop
entirely (it was masked under a nonexistent unit name anyway, and nobody
could point to a still-valid reason to keep it masked at all).

🤖 Generated with Claude Code

[HappyBasher]

Second update: Thomas pointed out that Jesko's "ich hab bei mir die
Dienste auch maskiert" means he masked systemd-networkd-wait-online.service
too - and for good reason: with systemd-resolved masked, boot otherwise
hangs at systemd-networkd-wait-online.service's ~120s timeout (systemd-networkd
apparently still tries pushing per-link DNS settings to the masked
systemd-resolved over D-Bus and stalls). That's almost certainly why this
masking was added in the first place back in 64d50bd.

Final fix (6ababe8): net result is unchanged from the original intent -
isc-dhcp-server6, systemd-networkd-wait-online.service and
systemd-resolved are all still masked. Only the wrong unit name
("networkd-wait-online.service" -> "systemd-networkd-wait-online.service")
is corrected.

🤖 Generated with Claude Code

[HappyBasher]

Third update: back to the originally-proposed DNSStubListener=no fix.

Jesko confirmed it on a second, independent production system:
https://ask.linuxmuster.net/t/beta-test-linuxmuster-net-7-4/12176/226

Ablauf bei uns (wie von Jürgen vorgeschlagen):

• Vorzustand: systemd-resolved.service und systemd-networkd-wait-online.service waren masked/inactive.
• systemctl unmask + enable für beide Units.
• /etc/systemd/resolved.conf.d/no-stub.conf mit [Resolve] DNSStubListener=no
• Neustart in der Reihenfolge systemd-resolved → systemd-networkd-wait-online → samba-ad-dc.

Verifikation: alle drei Units aktiv, systemctl --failed leer, Port 53
bleibt exklusiv bei Sambas eigenem DNS, interne und externe
DNS-Auflösung funktionieren, LDAPS/636 unverändert erreichbar, Journal
sauber.

Fixed by 0a0f4b0: both systemd-resolved and
systemd-networkd-wait-online.service stay enabled; only
systemd-resolved's DNS stub listener is disabled. Restart order matches
Jesko's verified procedure.

Released as linuxmuster-base7 7.3.42.

🤖 Generated with Claude Code

[HappyBasher]

Second step: idempotent repair for hosts already on 7.4 that went through
the old (masking) linuxmuster-release-upgrade before 7.3.42's fix.

Added share/fix-systemd-resolved_203.sh, invoked from
debian/postinst on every package upgrade. Detects whether
systemd-resolved.service or systemd-networkd-wait-online.service is
still masked, or the /etc/systemd/resolved.conf.d/no-stub.conf
(DNSStubListener=no) drop-in is missing, and if so unmasks + enables
both units, writes the drop-in, and restarts them - matching 7.3.42's
fix. Reports "nothing to do" and exits cleanly once already correct, so
it's a no-op on every subsequent upgrade. Only acts on hosts with a
samba-ad-dc.service unit. samba-ad-dc itself is deliberately not
restarted, to avoid a needless AD/DNS outage on an already-running
system.

Verified live end-to-end on a real, previously-broken host
(systemd-resolved was masked): fixed correctly, port 53 stayed
exclusive to Samba, short-hostname/AD-domain-SRV/external DNS resolution
all still work, and a second run correctly reported nothing left to do.

Fixed by 16d35c5, released as linuxmuster-base7 7.4.20 (branch 7.4).

🤖 Generated with Claude Code