# dnsmasq: this box's own resolver, and nothing else.
#
# It served a wildcard for a local namespace and a MagicDNS forwarder. Both are gone
# (2026-08-17) along with the name layer they belonged to. DO NOT ADD AN
# `address=` LINE BACK: it resolved names only on this box, so a made-up
# hostname got a 200 from the portal's catch-all and proved nothing, while every
# other device saw NXDOMAIN. Measured after removal - an unknown dotted name
# still fails in milliseconds without it.
#
# What is left is load-bearing: this is the resolver /etc/resolv.conf points at,
# and `domain-needed` at the bottom is what stops a leaked dotless container
# name starving libuv's thread pool. Never disable it.

# Bind ONLY the tailnet address. systemd-resolved owns 127.0.0.53 and would
# collide on a bare 0.0.0.0 bind. bind-dynamic (not bind-interfaces) so dnsmasq
# survives tailscale0 appearing after it at boot.
bind-dynamic
listen-address=100.117.176.85

# no-resolv stops dnsmasq reading WSL's auto-generated resolv.conf and looping
# back on itself. The upstream below is the real one.
no-resolv

# Loopback too, so /etc/resolv.conf can point here and the box resolves through
# its own dnsmasq. Docker ignores 127.x nameservers, so containers keep
# inheriting the NAT resolver exactly as before.
listen-address=127.0.0.1
server=10.255.255.254

# --- Never forward single-label names -------------------------------------
# A dotless name (`tempo`, `redis`, any bare container name that leaked out of a
# compose file into a HOST process) has no meaning outside a Docker network, but
# dnsmasq was forwarding it to the Windows resolver at 10.255.255.254, which
# silently drops such queries instead of answering NXDOMAIN. glibc then retried
# A and AAAA across both nameservers, so `getent hosts tempo` took 40 SECONDS to
# fail.
#
# That is not just slow, it is a correctness bug for any Node service: getaddrinfo
# runs on libuv's 4-thread pool, so a handful of hanging lookups starve every
# other lookup in the process. The Tals auth service hit exactly this - its
# OpenTelemetry exporter defaulted to `http://tempo:4318`, the repeated hanging
# `tempo` lookups occupied all 4 threads, and pg's own `localhost` lookup then
# could not get a thread inside its 5s connect timeout. Every login 500'd with
# "Connection terminated due to connection timeout" while the database sat
# perfectly healthy 2ms away.
#
# domain-needed makes dnsmasq answer NXDOMAIN immediately for names with no dot
# instead of forwarding them. Cost: `yehuda-hs` no longer resolves to its
# fe80:: link-local address, which was not usable without a zone index anyway.
# Anything real on this box (anything with a dot) has a dot.
domain-needed