hi everyone, does anybody have a workaround that fixes this pesky dns resolution issue when acme.certs... and BIND are running in a declarative nixos container?

Could not create client: get directory at 'https://acme-v02.api.letsencrypt.org/directory': Get "https://acme-v02.api.letsencrypt.org/directory": GET https://acme-v02.api.letsencrypt.org/directory giving up after 6 attempt(s): Get "https://acme-v02.api.letsencrypt.org/directory": dial tcp: lookup acme-v02.api.letsencrypt.org: Temporary failure in name resolution

so, by that, I mean that the issue does not seem to be pertaining to (in my case) networking.wireguard nor networking.bind which are both used and operate completely fine in the container. It is only after adding something like (per the manual):

      security.acme.certs."<redacted>"= {
        domain = "*<redacted>";
        dnsProvider = "rfc2136"; # allows us to do dns acme validation with local dns server
        environmentFile = "/var/lib/secrets/<redacted>.certs.secret";
        # We don't need to wait for propagation since this is a local DNS server
        dnsPropagationCheck = false;
      };

that the behavior occurs.

In the mean time netpleb - can you provide the following info from within the container:

• Logs of acme-$cert.service redacted as necessary
• Output of systemctl list-dependencies acme-$cert.service
• Output of systemctl list-dependencies bind.service

here's the redacted output (first time using local instance of ollama to do redacting!):

[root@hostname:~]# systemctl list-dependencies acme-example.com.service
acme-example.com.service
○ ├─acme-selfsigned-example.com.service
● ├─acme-setup.service
● ├─bind.service
○ ├─dns-rfc2136-conf.service
○ ├─nginx-config-reload.service
● ├─system.slice
● ├─acme-account-8bbd8b2b5078a14c2103.target
○ │ └─acme-jitsi.example.com.service
● ├─network-online.target
● ├─nss-lookup.target
● │ └─nscd.service
● └─sysinit.target
●   ├─dev-hugepages.mount
●   ├─dev-mqueue.mount
●   ├─firewall.service
○   ├─kmod-static-nodes.service
○   ├─suid-sgid-wrappers.service
○   ├─sys-fs-fuse-connections.mount
○   ├─sys-kernel-debug.mount
○   ├─sys-kernel-tracing.mount
●   ├─systemd-ask-password-console.path
○   ├─systemd-boot-random-seed.service
○   ├─systemd-hibernate-clear.service
○   ├─systemd-journal-catalog-update.service
●   ├─systemd-journal-flush.service
●   ├─systemd-journald.service
○   ├─systemd-machine-id-commit.service
○   ├─systemd-modules-load.service
○   ├─systemd-pstore.service
○   ├─systemd-random-seed.service
●   ├─systemd-resolved.service
●   ├─systemd-sysctl.service
●   ├─systemd-tmpfiles-setup-dev-early.service
●   ├─systemd-tmpfiles-setup-dev.service
●   ├─systemd-tmpfiles-setup.service
○   ├─systemd-tpm2-setup-early.service
○   ├─systemd-tpm2-setup.service
○   ├─systemd-udevd.service
○   ├─systemd-update-done.service
●   ├─systemd-update-utmp.service
●   ├─cryptsetup.target
●   ├─local-fs.target
○   │ └─systemd-remount-fs.service
●   └─swap.target
[root@hostname:~]# systemctl list-dependencies bind.service
bind.service
○ ├─dns-fix-zone-perms.service
○ ├─dns-rfc2136-conf.service
● ├─system.slice
● └─sysinit.target
●   ├─dev-hugepages.mount
●   ├─dev-mqueue.mount
●   ├─firewall.service
○   ├─kmod-static-nodes.service
○   ├─suid-sgid-wrappers.service
○   ├─sys-fs-fuse-connections.mount
○   ├─sys-kernel-debug.mount
○   ├─sys-kernel-tracing.mount
●   ├─systemd-ask-password-console.path
○   ├─systemd-boot-random-seed.service
○   ├─systemd-hibernate-clear.service
○   ├─systemd-journal-catalog-update.service
●   ├─systemd-journal-flush.service
●   ├─systemd-journald.service
○   ├─systemd-machine-id-commit.service
○   ├─systemd-modules-load.service
○   ├─systemd-pstore.service
○   ├─systemd-random-seed.service
●   ├─systemd-resolved.service
●   ├─systemd-sysctl.service
●   ├─systemd-tmpfiles-setup-dev-early.service
●   ├─systemd-tmpfiles-setup-dev.service
●   ├─systemd-tmpfiles-setup.service
○   ├─systemd-tpm2-setup-early.service
○   ├─systemd-tpm2-setup.service
○   ├─systemd-udevd.service
○   ├─systemd-update-done.service
●   ├─systemd-update-utmp.service
●   ├─cryptsetup.target
●   ├─local-fs.target
○   │ └─systemd-remount-fs.service
●   └─swap.target
[root@hostname:~]#