{ vars, ... }:

{
  networking = {
    hostName = "docker";
    hostId = "007f0200";
    useDHCP = false;
    interfaces.${vars.vmLanInterface}.ipv4.addresses = [{
      address = vars.dockerIp;
      prefixLength = vars.lanPrefixLength;
    }];
    defaultGateway = { address = vars.lanGateway; interface = vars.vmLanInterface; };
    nameservers = [ vars.domainControllerIp ];
  };
  boot.zfs.forceImportRoot = false;

  # Only advertise the LAN interface to IPA DNS. Without this, SSSD registers
  # every Docker bridge (172.x.x.x) as an A record for docker.sweet.home —
  # the default dyndns.interface = "*" catches them all.
  security.ipa.dyndns.interface = vars.lxcLanInterface; # eth0

  # Preserved from the pre-refactor `docker` target — stateVersion must never
  # be bumped on an already-installed machine.
  system.stateVersion = "25.05";
}