fix missing ForceRoutingPeerDNSResolution on the nmdata store path

management/internals/network_map_db/pgsql/network_map_data.go

@@ -81,6 +81,10 @@ func (pg *PgStore) GetNetworkMapData(ctx context.Context, accountId string) (*ne
 	if err != nil {
 		return rollbackAndReturnError(ctx, tx, err)
 	}
+	proxyTargetedDomainResourceIDs, err := GetProxyTargetedDomainResourceIDsViaPgxConnection(ctx, tx.Conn(), accountId)
+	if err != nil {
+		return rollbackAndReturnError(ctx, tx, fmt.Errorf("failed to get proxy targeted domain resources: %w", err))
+	}
 
 	resourcePolicies := make(map[string][]*nmdata.Policy)
 	for _, resource := range networkResources {
@@ -131,6 +135,8 @@ func (pg *PgStore) GetNetworkMapData(ctx context.Context, accountId string) (*ne
 		AppliedZoneCandidates:     dnsZones,
 		PrivateServiceCandidates:  buildPrivateServiceCandidates(services, domains, proxyPeers),
 		PostureCheckXIDToPublicID: postureCheckXIDToPublicID,
+
+		ProxyTargetedDomainResourceIDs: proxyTargetedDomainResourceIDs,
 	}
 
 	return &toret, nil

management/internals/network_map_db/pgsql/service.go

@@ -13,6 +13,14 @@ const (
 	from services
 	where account_id=$1
 	`
+
+	GetProxyTargetedDomainResourcesQuery = `
+	select t.target_id
+	from targets as t
+	join services as s on s.id = t.service_id
+	where s.account_id=$1 and s.enabled and not coalesce(s.terminated, false)
+	and t.enabled and t.target_type='domain' and t.target_id is not null
+	`
 )
 
 func (pg *PgStore) GetPrivateServices(ctx context.Context, accountId string) ([]service, error) {
@@ -32,6 +40,24 @@ func GetPrivateServicesViaPgxConnection(ctx context.Context, conn *pgx.Conn, acc
 	return pgx.CollectRows(rows, pgx.RowToStructByName[service])
 }
 
+func GetProxyTargetedDomainResourceIDsViaPgxConnection(ctx context.Context, conn *pgx.Conn, accountId string) (map[string]struct{}, error) {
+	rows, err := conn.Query(ctx, GetProxyTargetedDomainResourcesQuery, accountId)
+	if err != nil {
+		return nil, err
+	}
+
+	ids, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		return nil, err
+	}
+
+	toret := make(map[string]struct{}, len(ids))
+	for _, id := range ids {
+		toret[id] = struct{}{}
+	}
+	return toret, nil
+}
+
 type service struct {
 	Enabled      sql.NullBool
 	Private      sql.NullBool

management/server/types/account.go

@@ -978,34 +978,6 @@ func (a *Account) GetPeerConnectionResources(ctx context.Context, peer *nbpeer.P
 	return peers, fwRules, authorizedUsers, sshEnabled
 }
 
-// forcesRoutingPeerDNSResolution reports whether the given peer must run
-// routing-peer DNS resolution regardless of the account-global
-// RoutingPeerDNSResolutionEnabled setting. It returns true when the peer is a
-// router for a domain network resource that is targeted by an enabled
-// reverse-proxy service, so the peer's DNS forwarder starts and can resolve
-// the target for the embedded proxy peers. Embedded proxy peers themselves are
-// handled at PeerConfig build time.
-func (a *Account) forcesRoutingPeerDNSResolution(peerID string, routers map[string]map[string]*routerTypes.NetworkRouter) bool {
-	targeted := a.proxyTargetedDomainResourceIDs()
-	if len(targeted) == 0 {
-		return false
-	}
-
-	for _, resource := range a.NetworkResources {
-		if resource == nil || !resource.Enabled || resource.Type != resourceTypes.Domain {
-			continue
-		}
-		if _, ok := targeted[resource.ID]; !ok {
-			continue
-		}
-		if _, isRouter := routers[resource.NetworkID][peerID]; isRouter {
-			return true
-		}
-	}
-
-	return false
-}
-
 // proxyTargetedDomainResourceIDs returns the set of domain network resource IDs
 // targeted by an enabled, non-terminated reverse-proxy service.
 func (a *Account) proxyTargetedDomainResourceIDs() map[string]struct{} {

management/server/types/account_components.go

@@ -104,9 +104,5 @@ func (a *Account) GetPeerNetworkMapComponents(
 	groupIDToUserIDs map[string][]string,
 ) *NetworkMapComponents {
 	nmd := a.toNetworkMapData(accountZones, validatedPeersMap, resourcePolicies, routers, groupIDToUserIDs)
-	components := nmd.GetPeerNetworkMapComponents(peerID, TwinCustomZone(peersCustomZone))
-	if components != nil {
-		components.ForceRoutingPeerDNSResolution = a.forcesRoutingPeerDNSResolution(peerID, routers)
-	}
-	return components
+	return nmd.GetPeerNetworkMapComponents(peerID, TwinCustomZone(peersCustomZone))
 }

management/server/types/account_networkmapdata.go

@@ -108,6 +108,7 @@ func (a *Account) toNetworkMapData(
 		nmd.Routers[networkID] = twinInner
 	}
 
+	nmd.ProxyTargetedDomainResourceIDs = a.proxyTargetedDomainResourceIDs()
 	nmd.AppliedZoneCandidates = buildAppliedZoneCandidates(accountZones)
 	nmd.PrivateServiceCandidates = a.buildPrivateServiceCandidates()