IPv6 temporary (privacy) addresses rotate an interface's stable source
address out from under long-lived connected sockets. nginx's resolver
on middleman binds a UDP socket to the preferred temporary address at
worker start; once that address expires and is removed, the socket can
no longer send, so every upstream lookup fails with "could not be
resolved (timed out)" until nginx is restarted (which then binds the
next temporary address, so it recurs).
These are servers with no need for privacy addresses, so disable them
in networkdAssignment for every RA-accepting interface.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jackos1998
ab2308e765