Network Services Control

The agent runs a small set of network services alongside the data plane — among them the built-in DNS resolver and the DHCP server. Each one is independently switchable, so an operator can turn DNS or DHCP on or off, see whether it is actually listening, and tune how it binds and who may talk to it. This page covers the service command group, the DNS and DHCP configuration knobs, and the dns … / dhcp … operator commands. For zone and pool concepts, see DHCP & DNS.

The service command group

cenvero-str-ctl service shows and toggles the agent's switchable network services: the REST, gRPC and WebSocket management APIs, the Prometheus metrics endpoint, DNS, and DHCP. The local control socket that cenvero-str-ctl itself rides is always up and is deliberately not a toggleable service — it cannot be turned off.

Seeing what is running

cenvero-str-ctl service status

Network services
================
SERVICE        ENABLED  ADDRESS            STATE      NOTE
REST API       on       0.0.0.0:7070       listening
gRPC API       on       0.0.0.0:7071       listening
WebSocket API  on       0.0.0.0:7072       listening
Metrics        on       127.0.0.1:9090     listening
DNS            on       10.0.0.1:53        listening
DHCP           on       :67                listening

ENABLED reflects the operator switch (applied at next restart); STATE is a live listen probe.
Apply a change with:  systemctl restart cenvero-stratum

The two columns mean different things:

• ENABLED is the operator switch — what the agent would start on its next restart.
• STATE is a live probe of the address: listening (something is bound there now), down (nothing is), or unknown (the address could not be probed).

status also answers to list, top, ls, and ps, and a bare cenvero-str-ctl service prints the same table. Add --format json (or yaml) for machine-readable output.

Turning a service on or off

Both word orders work, as do the enable/disable aliases:

# Turn the DNS resolver off
sudo cenvero-str-ctl service dns off

# Turn the DHCP server back on (these are equivalent)
sudo cenvero-str-ctl service dhcp on
sudo cenvero-str-ctl service on dhcp
sudo cenvero-str-ctl service enable dhcp

Toggling a service records its enable flag in the agent's local override store — the same mechanism config set uses — so the change persists across reboots. It is not applied to the running process immediately: it takes effect on the next agent restart. The command reminds you how:

Service dns (DNS) disabled.
Verify with:  cenvero-str-ctl service status

sudo systemctl restart cenvero-stratum

DNS and DHCP only switch their network listeners. With DHCP off, the agent stops binding UDP :67 (it hands out no addresses) but the lease table and its expiry bookkeeping keep running, so existing leases are still tracked. With DNS off, the resolver does not bind a port; zone and record data is untouched and still served over the management API. Turning the service back on and restarting re-binds it.

The IPC control socket cannot be disabled — asking to turn off ipc (or socket) is refused with an explanation rather than silently accepted, because it is the channel this very command travels over.

Configuring DNS

The agent is authoritative for each network's internal zone (e.g. app-net.internal) and acts as a recursive forwarder for everything else. Two settings control where it listens and who may use it for recursion.

Listen address

By default the resolver binds the management bridge's IPv4 address (falling back to the user bridge, then loopback 127.0.0.1:53 before a bridge has an address). It is never bound to a wildcard such as 0.0.0.0:53, so it is not exposed as an open forwarder on an untrusted NIC.

To pin it to a specific address, set dns_listen_addr to a bare IP or a host:port. config set takes the key and value positionally:

sudo cenvero-str-ctl config set dns_listen_addr 10.0.0.1

Setting it back to empty reverts to the bridge-address default:

sudo cenvero-str-ctl config set dns_listen_addr ""

The address change is applied on the next agent restart; confirm the resulting bind with service status.

Allowed clients (recursion ACL)

Recursion — forwarding a query for a name outside the local zones to an upstream resolver — is gated by a client ACL so the agent is never an open resolver. Set the allowed clients as a comma-separated list of IPs and/or CIDRs:

sudo cenvero-str-ctl config set dns_allowed_clients "10.20.0.0/24,10.30.0.0/24"

When the list is empty (the default) it falls back to the loopback and private ranges (127.0.0.0/8, ::1/128, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7). A query from a client outside the allowed set is refused, not silently forwarded. Authoritative answers for the local zones are always returned regardless of the ACL.

Zones, records, and forwarders

Day-to-day zone and record management uses the dns command group:

Zones and records are addressed by their numeric ids, which dns zones and dns list report:

# List zones to find the zone id, then add and remove a record
cenvero-str-ctl dns zones
sudo cenvero-str-ctl dns record add 1 api A 10.20.0.55 300
cenvero-str-ctl dns list 1
sudo cenvero-str-ctl dns record delete 3

dns add and dns delete are shorthand aliases for dns record add and dns record delete.

Upstream forwarders (the resolvers recursion is sent to) are managed live with the dns forwarder list/set/add/remove commands and take effect on the running agent; persist them across restarts with config set dns_upstreams <ip,...>. See DHCP & DNS → Upstream forwarders.

Configuring DHCP

The DHCP server leases addresses to each network's endpoints from that network's IPAM pool and binds UDP :67 while it is enabled.

Scopes

A scope binds a client subnet to its own IPAM pool and the reply parameters advertised to clients on that subnet — the server identity, gateway, subnet mask, DNS servers, and an optional per-scope lease length. A relayed request is matched to its scope by the relay's giaddr; a directly-attached one by the interface it arrived on. A network created with network create gets a scope automatically; multiple scopes let one agent serve several subnets (including relayed ones).

Scopes (dhcp_scopes) are part of the node's configuration rather than a live config set field — they are provisioned with the node config, not set on the node. Each scope carries:

Reservations and leases

Use the dhcp command group to inspect leases and to pin or release an address:

The reserved IP selects its own pool, so these commands identify a client by MAC rather than by network:

# Always hand db-primary the same address
sudo cenvero-str-ctl dhcp reserve \
  --mac 52:54:00:de:ad:01 \
  --ip 10.30.0.10 \
  --hostname db-primary

# Inspect what is leased, and what is pinned
cenvero-str-ctl dhcp leases
cenvero-str-ctl dhcp reservations

# Release a reservation before re-provisioning a workload
sudo cenvero-str-ctl dhcp release --mac 52:54:00:ab:01:02

A reservation pins the address only — it does not create a DNS record. To make the hostname resolve to the reserved IP, add a DNS record for it with dns record add (or the API). See DHCP & DNS → Reservations for how reservations and the lease table behave in more depth.

Quick reference

See also

• DHCP & DNS — pools, leases, zones, and forwarders in depth.
• Networking Overview — where DNS and DHCP sit in the data plane.
• Zero-Trust Firewall — DNS on port 53 must be explicitly allowed for cross-network queries.
• Configuration — how settings reach a node and what lives in the node config.
• CLI Reference — the full command surface.