# Hive-internal DNS resolver + DHCP, co-located in the gateway
# container — single front-door for both DNS and HTTP, saves a
# sibling container. Listens on the bridge interface from
# `services.hyperhive.network`; authoritative for the hive domain +
# sub-domains, forwards everything else upstream. Returns the
# `services.dnsmasq` value for the container config (see
# ./default.nix); the DHCP pool bounds are computed by hive-network.
{
  lib,
  networkCfg,
  forgeCfg,
  matrixCfg,
  hyperhiveDomain,
}:
{
  enable = true;
  # Don't substitute the container's /etc/resolv.conf — the gateway
  # uses the host's resolver for its own outbound traffic; dnsmasq is
  # purely for incoming queries from agent containers.
  resolveLocalQueries = false;
  settings = {
    # Bind only on the bridge interface (and lo for health-checks).
    # Outside hosts can't even see the listener.
    interface = [
      networkCfg.bridgeName
      "lo"
    ];
    bind-interfaces = true;
    port = 53;
    # Hive authoritative records — answer queries for the hive domain
    # + its sub-domains with the bridge IP, where nginx is reachable
    # from every container netns.
    #
    # The forge / matrix entries are redundant in the common case
    # where `forge.domain` / `matrix.gatewayHost` are sub-domains of
    # `hyperhive.domain` — dnsmasq's `/<domain>/` rule already matches
    # sub-domains. Kept explicit because operators can override either
    # to a cross-domain hostname (e.g. `forge.domain =
    # "git.example.com"`); listing them explicitly keeps that case
    # routed without needing an extra config block.
    address = [
      "/${hyperhiveDomain}/${networkCfg.bridgeIp}"
    ]
    ++ lib.optional ((forgeCfg.behindGateway or false)) "/${forgeCfg.domain}/${networkCfg.bridgeIp}"
    ++ lib.optional (
      matrixCfg.enable && matrixCfg.gatewayHost != null
    ) "/${matrixCfg.gatewayHost}/${networkCfg.bridgeIp}";
    # DHCP pool covering all usable host addresses on the bridge
    # subnet — bounds computed by hive-network.nix from
    # bridgeIp/bridgePrefixLength. All containers (agents and service
    # containers such as hive-ci) receive their IPs dynamically.
    dhcp-range = "${networkCfg.dhcpRangeStart},${networkCfg.dhcpRangeEnd},1h";
    dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
    # No explicit upstream: non-hive queries follow dnsmasq's
    # resolv.conf default — the gateway container's `/etc/resolv.conf`,
    # which nixos-container copies from the host at every start, so the
    # hive always uses the host's resolvers. resolvconf is disabled in
    # the container (see ./default.nix) so nothing regenerates that
    # copy.
  };
}