{ vars, ... }:

{
  # Run dnsmasq on the LAN interface as a forwarding-only resolver for
  # *.ts.net (Tailscale MagicDNS names). FreeIPA's bind-dyndb-ldap
  # cannot reach 100.100.100.100 (Tailscale's internal resolver) directly
  # because the DC is not a Tailscale node. This host IS a Tailscale node
  # and can reach 100.100.100.100 via its tailscale0 interface, so it
  # acts as an intermediary: FreeIPA has a conditional forward zone for
  # ts.net pointing here (vars.tailscaleRouterIp), and this dnsmasq
  # instance forwards those queries onward to Tailscale's resolver.
  #
  # Configure FreeIPA once after deploying this host:
  #   kinit admin
  #   ipa dnsforwardzone-add ${vars.tailnetDomain} \
  #     --forwarder=${vars.tailscaleRouterIp} \
  #     --forward-policy=only
  # Note: IPA refuses to shadow ts.net (a real public TLD); use the
  # tailnet-specific subdomain (vars.tailnetDomain) instead.
  services.dnsmasq = {
    enable = true;
    settings = {
      # Listen only on the LAN interface — not tailscale0 or loopback.
      # bind-interfaces prevents dnsmasq from binding to 0.0.0.0 and
      # then filtering by interface later; combined with `interface` this
      # ensures it genuinely listens only on eth0.
      bind-interfaces = true;
      interface = [ vars.lxcLanInterface ];

      # Forward-only: no local /etc/hosts or /etc/resolv.conf reading,
      # no negative caching of NXDOMAIN for names this instance doesn't
      # serve. All ts.net queries come from FreeIPA's conditional forwarder
      # and must be answered by Tailscale's resolver.
      no-hosts = true;
      no-resolv = true;

      # Tailscale's internal "Quad100" resolver — reachable from any
      # Tailscale node via the tailscale0 interface. Scoped to the
      # specific tailnet subdomain (vars.tailnetDomain) rather than
      # all of ts.net: FreeIPA refuses to shadow ts.net (a real public
      # TLD with DNSimple nameservers) so the conditional forward zone
      # in FreeIPA must use the tailnet-specific subdomain instead:
      #   ipa dnsforwardzone-add ${vars.tailnetDomain} \
      #     --forwarder=${vars.tailscaleRouterIp} \
      #     --forward-policy=only
      server = [ "/${vars.tailnetDomain}/100.100.100.100" ];
    };
  };

  networking.firewall.allowedUDPPorts = [ 53 ];
  networking.firewall.allowedTCPPorts = [ 53 ];
}