One expired key took down external DNS for 18 containers, and it looked like an app bug the whole time.

It surfaced as Phish setlists showing "not posted." Narrow symptom, so I chased it narrowly. The actual cause was nix1's Tailscale node key quietly expiring overnight, which killed MagicDNS. The host failed over to public resolvers and kept working fine, and so did anything freshly started. That's exactly why it hid so well. Long-running Docker bridge containers pin their DNS upstream at start time, so they were still forwarding to a resolver that no longer existed. Cached data kept rendering. Only live external reads failed.

Once I stopped looking at one service and looked fleet-wide: the model gateway, n8n, alertmanager, grafana, vaultwarden, and uptime-kuma cheerfully reporting false downs while being broken itself.

Re-login revived MagicDNS and most containers healed on their next lookup. Three had sticky resolvers and needed a restart. Then I killed the actual trigger: turned off key expiry for that node, and pinned Docker's DNS to the LAN gateway in daemon.json so containers never depend on MagicDNS again.

A symptom that shows up in one app is not evidence the problem lives in one app.