{ vars, ... }:
{
  networking = {
    hostName = vars.haDocker2Host;
    hostId   = "a2d0c4e2";
    useDHCP  = false;
    interfaces = {
      # ens18 — LAN management NIC (vmbr0, 192.168.2.0/24)
      ${vars.vmLanInterface}.ipv4.addresses = [{
        address      = vars.haDocker2Ip;
        prefixLength = vars.lanPrefixLength;
      }];
      # ens19 — storage-client NIC (vmbr2, 192.168.20.0/24) — NFS from HA cluster
      ${vars.haDockerStorageInterface}.ipv4.addresses = [{
        address      = vars.haDocker2StorageIp;
        prefixLength = vars.haClientPrefixLength;
      }];
      # ens20 — swarm cluster NIC (vmbr3, 192.168.30.0/24) — Docker gossip + VXLAN
      ${vars.haDockerSwarmInterface}.ipv4.addresses = [{
        address      = vars.haDocker2SwarmIp;
        prefixLength = vars.haDockerSwarmPrefixLength;
      }];
    };
    defaultGateway = { address = vars.lanGateway; interface = vars.vmLanInterface; };
    nameservers    = [ vars.domainControllerIp ];
  };

  # Only register the LAN IP with IPA DNS — same reasoning as ha-docker-1.
  security.ipa.dyndns.interface = vars.vmLanInterface;

  system.stateVersion = "26.05";
}