feat: hive DNS always follows the host resolver

nix/host-modules/hive-gateway/default.nix

@@ -163,6 +163,16 @@ in
         {
           system.stateVersion = "26.05";
 
+          # Keep the host-copied /etc/resolv.conf intact. nixos-container
+          # copies the host's file in at every container start, but
+          # resolvconf's host-tracking mode then regenerates it — to an
+          # empty file, since the host file doesn't cross the boundary
+          # after start (the same failure the matrix container hit).
+          # With resolvconf off, nothing touches the copy: nginx's own
+          # lookups (ACME) and dnsmasq's follow-the-host upstream
+          # default (see ./dnsmasq.nix) both read the host's resolvers.
+          networking.resolvconf.enable = false;
+
           # ACME (Let's Encrypt) integration. nginx vhosts set
           # `enableACME = true` via the vhost builder; this provides the
           # shared ACME config (acceptTerms + email). The gateway

nix/host-modules/hive-gateway/dnsmasq.nix

@@ -27,10 +27,6 @@
     ];
     bind-interfaces = true;
     port = 53;
-    # Don't read /etc/resolv.conf — we control upstream explicitly to
-    # dodge dependency on the gateway container's own resolver state.
-    no-resolv = true;
-    server = networkCfg.upstreamDns;
     # Hive authoritative records — answer queries for the hive domain
     # + its sub-domains with the bridge IP, where nginx is reachable
     # from every container netns.
@@ -55,5 +51,11 @@
     # containers such as hive-ci) receive their IPs dynamically.
     dhcp-range = "${networkCfg.dhcpRangeStart},${networkCfg.dhcpRangeEnd},1h";
     dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
+    # No explicit upstream: non-hive queries follow dnsmasq's
+    # resolv.conf default — the gateway container's `/etc/resolv.conf`,
+    # which nixos-container copies from the host at every start, so the
+    # hive always uses the host's resolvers. resolvconf is disabled in
+    # the container (see ./default.nix) so nothing regenerates that
+    # copy.
   };
 }