Configure MagicDNS

What MagicDNS brings

Memorizing IP addresses makes no sense for a human, and VIGIL addresses are drawn from a private space that is hard to remember. MagicDNS solves this problem by giving each machine a short, stable name, resolved the same way everywhere in the network. You reach your machines by a name, your scripts and bookmarks stay readable, and the underlying address can vary without breaking access.

• One short name per machine, resolved identically from any member of the network.
• Purely local resolution: no dependency on an outside DNS server for the VIGIL network's names.
• No metadata leak: the list of who talks to whom cannot be reconstructed by a DNS resolver or by a network observer.
• A namespace private to the network: two distinct organizations can use the same names without interference, each within its own mesh.

Local resolution (no query goes out)

The important point is that VIGIL name resolution relies on no outside DNS server. The name-to-address mapping is already present on the machine, in the signed network map (netmap) the controller distributes, and the agent serves it itself. Nothing is asked of an external resolver for the network's names.

1. 1
   The controller distributes a signed network mapIt contains, for each machine on the network, its name and its VIGIL addresses. The signature guarantees the map has not been altered.
2. 2
   The agent resolves VIGIL names locallyWhen an application asks for a network name, the agent answers directly from the map, without emitting the slightest query to an external resolver.
3. 3
   No DNS query leaves the nodeNeither the internet provider, nor a public resolver, nor the VIGIL infrastructure learns which device is trying to reach another.

Naming and renaming machines

Names are administered, not guessed. Each machine carries a stable internal name, chosen at enrollment and modifiable afterwards, and it is this name that serves as the anchor. Renaming it updates the signed network map without changing the underlying VIGIL address: your address-based accesses remain valid even after a rename, and the change propagates by itself to the other members.

• The initial name is set at the machine's enrollment; it can be modified later from the console.
• A rename propagates through the signed network map the controller redistributes; it requires no reconfiguration on the client side.
• The VIGIL address does not change on a rename: a service, a rule or a bookmark based on the address remains valid.
• Since the namespace is private to the network, the same name can coexist without conflict in two distinct organizations.

Good practices

MagicDNS requires few settings, but a few habits make a fleet more readable and more stable over time. The general idea is to treat names as an administered directory: consistent, predictable, and decoupled from addresses.

• Adopt a clear and consistent naming convention (role, site, environment): it holds for the fleet's entire lifetime.
• Prefer the name to the address in your scripts, rules and bookmarks: the name survives a change of location or of physical network.
• Rename rather than re-enroll: a rename preserves the machine's identity and address, whereas re-enrolling creates a new identity.
• Remember that only the VIGIL network's names go through MagicDNS; public names keep being resolved by your system, without interception.