server:
    interface: 0.0.0.0
    access-control: 0.0.0.0/0 allow
    cache-min-ttl: 0
    cache-max-ttl: 60
    verbosity: 1
    do-daemonize: no
    do-not-query-localhost: no

    # Simulated DNS overrides (served directly by unbound)
    # Let's Encrypt ACME endpoints → Pebble
    local-data: "acme-v02.api.letsencrypt.org. IN A 100.64.0.100"
    local-data: "acme-staging-v02.api.letsencrypt.org. IN A 100.64.0.100"
    # E2E registry container
    local-data: "e2e-registry.lab. IN A 100.64.0.56"
    # npm-compat registry simulator — serves @celilo/* tarballs to
    # downstream consumers (install.sh + the npm-cache-node module's
    # upstream when point-of-truth tests need a public-resolvable
    # upstream URL). Mirrors the internal-resolver entry; without it,
    # tests that replace the dns-int simulator with a real deployment
    # (knot-unbound-internal) lose the override and the cache can't
    # reach upstream.
    local-data: "npm-registry.lab. IN A 100.64.0.59"
    # MinIO S3 simulator — backup/restore target. See SIMULATOR_IPS.MINIO.
    local-data: "minio.lab. IN A 100.64.0.61"
    # apt-repo simulator. Also needed HERE, not only in the internal resolver:
    # module target hosts resolve through the PUBLIC resolver, and in production
    # apt.celilo.computer is a publicly-resolvable name — so a host fetching a
    # package from it is the faithful case, not a shortcut.
    local-data: "apt.celilo.lab. IN A 100.64.0.60"
    # signal-cli daemon (real, unlinked) and its simulator counterpart. Both
    # sit on the `internal` network — celilo-mgr reaches a notification
    # transport locally; a transport needing public ingress could not tell
    # you the ingress was broken.
    local-data: "signal-cli.lab. IN A 10.226.1.90"
    local-data: "signal-sim.lab. IN A 10.226.1.91"
    # signal-cli release host — the sim internet's stand-in for GitHub
    # releases, so the signal module's deploy-time download resolves inside
    # the sealed network. See SIMULATOR_IPS.SIGNAL_RELEASE.
    local-data: "signal-release.lab. IN A 100.64.0.62"
    # IP echo simulator — the rig's api.ipify.org. celilo's `public_dns` check
    # asks it the one thing the fleet cannot ask itself: what address it is
    # currently reachable at. See SIMULATOR_IPS.IP_ECHO.
    local-data: "ip-echo.lab. IN A 100.64.0.65"
    # External website prober simulator — without this override, isitup.org
    # falls through the "forward-zone: ." below and resolves to the REAL
    # Namecheap-parked domain on the public internet.
    local-data: "isitup.org. IN A 100.64.0.57"

# Simulated domains → namecheap-dns (authoritative)
stub-zone:
    name: "iamtheinternet.org."
    stub-addr: 100.64.0.55

stub-zone:
    name: "example.net."
    stub-addr: 100.64.0.55

# celilo.computer hosts the website + install.sh (served by the website-sim).
# Without this stub it falls through to the real internet (203.0.113.11), so the
# website-sim's ACME challenge can't be validated in-topology and the bake's
# `curl https://celilo.computer/install.sh` never sees a cert. Covers
# www.celilo.computer too. (ISS-0063)
stub-zone:
    name: "celilo.computer."
    stub-addr: 100.64.0.55

stub-zone:
    name: "park-your-domain.com."
    stub-addr: 100.64.0.55

# The OFF-FLEET web host's domain (external_web). Like every other simulated
# domain it needs a stub, or it falls through to the real internet — and
# tangohost.com is a REAL registered name out there, so the leak resolves to a
# real address and the SSH bootstrap times out against a stranger's server.
# namecheap-dns is authoritative for the zone; the zone points at the host's own
# public address (100.64.0.63), NOT the customer firewall, because the host
# genuinely is a third party on the internet.
stub-zone:
    name: "tangohost.com."
    stub-addr: 100.64.0.55

# Everything else → the real internet, via Docker's embedded resolver.
#
# 127.0.0.11 is Docker's per-container DNS; it relays to whatever the HOST is
# configured to use. Hardcoding 8.8.8.8/1.1.1.1 here made the whole harness
# unrunnable on any network that blocks direct UDP/53 to public resolvers —
# corporate networks and some ISPs force their own resolver, and the symptom is
# deeply unhelpful: unbound times out, squid's `dns_nameservers` times out with
# it, and `bun add` reports "ConnectionRefused downloading package manifest
# drizzle-orm" from inside the bake. Going through the host's resolver works
# everywhere the host itself has working DNS, which is the actual requirement.
#
# `do-not-query-localhost: no` above is what permits this.
forward-zone:
    name: "."
    forward-addr: 127.0.0.11