# Route internal AD-zone lookups straight to the Samba DC instead of the LAN
# router, for every pod in the cluster.
#
# WHY: k3s CoreDNS forwards to the node's /etc/resolv.conf, which lists the
# router (192.168.10.1) — and that resolver flaps. When it hangs, CoreDNS's
# forward plugin blocks and even CLUSTER-INTERNAL lookups
# (*.svc.cluster.local) start timing out, which is how Authelia ended up in
# CrashLoopBackOff: its startup check resolves both dc1.ad.ddupan.top and
# smtp-relay.smtp-relay.svc.cluster.local, and a strict startup check turns a
# transient DNS blip into a restart loop.
#
# dc1 is AUTHORITATIVE for ad.ddupan.top, so sending that zone directly to it
# removes the router from the path entirely — no forwarding, no upstream
# dependency, no flap.
#
# k3s picks this up via `import /etc/coredns/custom/*.server` in its Corefile.
# The `reload` plugin applies it without restarting CoreDNS.
apiVersion: v1
kind: ConfigMap
metadata:
  name: coredns-custom
  namespace: kube-system
data:
  ad-ddupan-top.server: |
    ad.ddupan.top:53 {
        errors
        cache 30
        forward . 192.168.10.5 {
            policy sequential
        }
    }
  # ── stop search-domain permutations from hanging on the router ──────────
  # Pods get `options ndots:5` plus the NODE's search list, which still carries
  # `lab.ddupan.top` (the RETIRED domain) and tailscale's MagicDNS suffix. A name
  # like dc1.ad.ddupan.top has only 3 dots, so glibc tries EVERY suffix first:
  #   dc1.ad.ddupan.top.tail7e769.ts.net
  #   dc1.ad.ddupan.top.lab.ddupan.top
  # Both are forwarded upstream to the flaky router and time out, so the client
  # gives up before the bare name is ever tried. That is what put Authelia in
  # CrashLoopBackOff -- and it hit the cluster-internal smtp-relay name too
  # (4 dots < ndots:5).
  #
  # Answer these locally with an instant NXDOMAIN. Neither zone should ever
  # resolve from inside the cluster.
  dead-search-domains.server: |
    lab.ddupan.top:53 {
        errors
        template ANY ANY {
            rcode NXDOMAIN
        }
    }
    tail7e769.ts.net:53 {
        errors
        template ANY ANY {
            rcode NXDOMAIN
        }
    }
  # Split-horizon blocks are generated from ../../infrastructure/dns/records.yml.
  # They keep pod traffic on the LAN while preserving public hostnames and LE certs.
  # BEGIN GENERATED: homelab DNS (coredns)
  git-ddupan-top.server: |
    git.ddupan.top:53 {
        errors
        template IN A {
            answer "{{ .Name }} 60 IN A 192.168.10.127"
        }
        template IN AAAA {
            rcode NOERROR
        }
    }
  auth-ddupan-top.server: |
    auth.ddupan.top:53 {
        errors
        template IN A {
            answer "{{ .Name }} 60 IN A 192.168.10.127"
        }
        template IN AAAA {
            rcode NOERROR
        }
    }
  # END GENERATED: homelab DNS (coredns)
---
# NOTE: `serve_stale` could NOT be added here.
#
# The cache plugin already exists in k3s's own Corefile (`cache 30`), and CoreDNS
# rejects a duplicate plugin in the same server block — so the *.override import
# cannot carry it. It was applied by patching the `coredns` ConfigMap directly;
# the intended Corefile is kept alongside as `Corefile.desired`.
#
# ⚠️ A k3s restart/upgrade re-applies its bundled manifest and will REVERT that
# patch. Re-apply from Corefile.desired if external name resolution starts
# failing hard during WAN outages again.
#
# WHY: the ISP drops the WAN at random and it cannot be changed. serve_stale
# keeps answering with expired entries while the upstream is unreachable, so
# previously-resolved external names (smtp.office365.com, package mirrors) keep
# working through a blip instead of hanging.