{
  "module": "dnsmasq",
  "version": "1",
  "provides": [
    "wildcard-resolution"
  ],
  "claims": [
    {
      "name": "the-dns-port",
      "scope": "node"
    }
  ],
  "listens": [
    {
      "port": 53,
      "protocol": "udp",
      "from": "mesh",
      "why": "names under every machine in this mesh, for this machine and what it runs",
      "fixed": true
    }
  ],
  "resources": [
    {
      "id": "package",
      "type": "package",
      "package": "dnsmasq"
    },
    {
      "id": "config",
      "type": "file",
      "path": "/etc/dnsmasq.conf",
      "mode": "0644",
      "content": "# Managed by the mesh. dnsmasq's own defaults are replaced whole rather than\n# patched, because this module owns the file and a patch would leave whatever\n# was there before to be discovered later.\n\n# What the mesh computed: one wildcard per machine, its name and everything\n# under it. Rewritten whenever a machine joins or leaves, which is why the\n# service below reflects it.\nconf-file=/etc/mesh-resolver/nodes.conf\n\n# Where it answers. Both are names the mesh chose, so this file needs to know\n# nothing about this particular machine:\n#\n#   mesh0        the private network, so anything on it \u2014 including a container\n#                on this machine \u2014 can ask.\n#   127.0.0.55   this machine's own use, for whatever points resolution at the\n#                mesh. Not .53 or .54: systemd-resolved holds BOTH \u2014 .53 is its\n#                stub and .54 its proxy stub \u2014 which this module asserted was\n#                free until a machine said otherwise.\n#\n#                Listening on a loopback address makes dnsmasq take the rest of\n#                loopback with it, 127.0.0.1 included. That is why this module\n#                claims `the-dns-port`: it takes the machine's DNS port, and\n#                saying it takes only one address would be the same kind of\n#                comfortable claim that .54 was free.\n#\n#                .55 is a convention and not a reservation. If a future systemd\n#                takes it, this line changes and nothing else does, which is the\n#                reason it is written once here rather than in each module that\n#                points at it.\n#\n# bind-dynamic rather than bind-interfaces: mesh0 does not exist until the\n# machine is on the private network, and binding an interface that is not there\n# yet fails to start rather than waiting for it.\nbind-dynamic\ninterface=mesh0\nlisten-address=127.0.0.55\n\n# **It forwards nothing, and must not read resolv.conf to find out where to.**\n# Whatever points this machine at the mesh writes its own address into\n# resolv.conf \u2014 so a resolver that read it for upstreams would find itself,\n# and every query it could not answer locally would loop until its receive\n# queue filled. That is not theoretical: it filled with 15KB of queries and\n# every lookup on the machine hung.\n#\n# It needs no upstream because it is never asked for anything else: the\n# asking module routes only the mesh's suffix here and leaves the rest\n# wherever the machine already sent it.\nno-resolv\ndomain-needed\nbogus-priv\n"
    },
    {
      "id": "service",
      "type": "service",
      "unit": "dnsmasq.service",
      "state": "running",
      "boot": "enabled",
      "restart-on": [
        "config",
        "dnsmasq.fact-node-zones"
      ]
    }
  ],
  "facts": {
    "node-zones": "/etc/mesh-resolver/nodes.conf"
  }
}