{ vars, ... }:
{
  networking = {
    hostName = vars.haDocker1Host;
    hostId   = "a1d0c4e1";
    useDHCP  = false;
    interfaces = {
      # ens18 — LAN management NIC (vmbr0, 192.168.2.0/24)
      ${vars.vmLanInterface}.ipv4.addresses = [{
        address      = vars.haDocker1Ip;
        prefixLength = vars.lanPrefixLength;
      }];
      # ens19 — storage-client NIC (vmbr2, 192.168.20.0/24) — NFS from HA cluster
      ${vars.haDockerStorageInterface}.ipv4.addresses = [{
        address      = vars.haDocker1StorageIp;
        prefixLength = vars.haClientPrefixLength;
      }];
      # ens20 — swarm cluster NIC (vmbr3, 192.168.30.0/24) — Docker gossip + VXLAN
      ${vars.haDockerSwarmInterface}.ipv4.addresses = [{
        address      = vars.haDocker1SwarmIp;
        prefixLength = vars.haDockerSwarmPrefixLength;
      }];
    };
    defaultGateway = { address = vars.lanGateway; interface = vars.vmLanInterface; };
    nameservers    = [ vars.domainControllerIp ];
  };

  # Only register the LAN IP with IPA DNS.  Without this, sssd dyndns
  # would also register Docker bridge IPs (172.x.x.x) and the storage/swarm
  # NIC IPs as A records for ha-docker-1.sweet.home.
  security.ipa.dyndns.interface = vars.vmLanInterface;

  system.stateVersion = "26.05";
}