mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-24 16:41:30 +02:00
91dd9fa239
The zone a private service's synthesized A record hangs under was derived from the serving proxy's address or from a validated custom domain. A placement-free endpoint matches neither, so the apex came out empty, the service was skipped, and the tenant's hostname resolved to nothing -- with no error logged. Synthesized services now carry their zone explicitly and it is preferred when deriving the apex. The field is in-memory only: these services are built per read and never persisted, and the zone cannot be supplied as a parameter instead because it is captured per account at allocation time, so a single current-config value would misclassify any tenant allocated under a previous one. A blanket "use the parent of the hostname" fallback was rejected: the same empty apex also occurs for a service whose domain has no validated entry for its cluster, and those resolve to nothing deliberately, so a blanket fallback would turn domain validation into a no-op.