Why do I have Bind and Unbound on my system with systemd-resolved?

Help
1

I just did a nh os switch . to update my machine and realized I have both Bind and Unbound DNS servers, even though I have services.resolved.enable = true in my configuration.

I tried to find the dependencies in my system with nix why-depends, but there’s none:

$ nix why-depends /run/current-system $(nix eval --raw nixpkgs#bind)
this path will be fetched (446.1 KiB download, 1.6 MiB unpacked):
  /nix/store/vi2f09i6g7d6frf5bds406qi3ys95za2-bind-9.20.23
'/nix/store/0yd553pikxl6ln2hj0szvxjimn4dyw60-nixos-system-L14-26.11.20260616.567a49d' does not depend on '/nix/store/vi2f09i6g7d6frf5bds406qi3ys95za2-bind-9.20.23'

$ nix why-depends /run/current-system $(nix eval --raw nixpkgs#unbound)
this path will be fetched (1.1 MiB download, 2.9 MiB unpacked):
  /nix/store/py27hqaanrqka5ahwn6pcnffafi6xpzn-unbound-1.25.0
'/nix/store/0yd553pikxl6ln2hj0szvxjimn4dyw60-nixos-system-L14-26.11.20260616.567a49d' does not depend on '/nix/store/py27hqaanrqka5ahwn6pcnffafi6xpzn-unbound-1.25.0'

How do I find out why I have 3 different DNS resolvers in my machine? And how could I “simplify” this to use only systemd-resolved instead?

Here are my NixOs configs.

2

What makes you think that? Just because something is in your nix store doesn’t mean it’s a dependency of your current system config - you’d have to query for the gcroot associated with whatever path.

Also, we don’t know what else is in your config, so share it.

This isn’t how you do this, by the way; use something like nix-tree and search there for bind and co.

3

Oh, sorry, should have posted a link somewhere, my bad. Here it is my Nixos configs.

When I hit nh os switch ., two of the lines in the Changed section are:

[U*] bind                                     9.20.23-host, 9.20.23-lib, 9.20.23-man -> 9.20.24-host, 9.20.24-lib, 9.20.24-man
[U.] unbound                                  1.25.0-lib ×2, <others> -> 1.25.1-lib ×2, <others>

According to this, U means Upgrade; * means “Package is selected; state unchanged”; and . means “Not in environment.systemPackages; dependency”. So, unbound is a dependency of something I have, right? And bind is also there? Or am I hallucinating this?

Oh, didn’t know about nix-tree, thanks for the tip!

bind appears there, as a child of system-path.
unbound appears as a child of gnutls, that is a child of many things?

1 Like
4

You may just have libraries and shell utilities provided by these packages, and not their recursive resolver daemons. For bind I’m sure of this: the -host output provides the host utility and nothing else, and the -lib and -man outputs presumably are libraries and documentation. For unbound it depends on what <others> means, but it makes sense that gnutls might depend on a DNS client library provided by unbound (e.g. allowing it to look up TLSA records).

3 Likes
5

For more on what multiple “outputs” means here: https://nixos.org/manual/nixpkgs/unstable/#chap-multiple-output

You can also run something like nixos-option environment.systemPackages and look for bind or host there, since that’s what populates system-path - if you’re curious which file adds that bind^host package in.

1 Like