# roles/thin-client/network/dns.nix
#
# DNS strategy: Corp DNS (AD DCs) as primary, NetBird DNS as overlay
# for NetBird-managed domains via systemd-resolved.
#
# Q15 decision: "Corp DNS + NetBird DNS parallel".
{config, lib, ...}: let
  inherit (lib) mkIf;
  cfg = config.az.tc;
in {
  config = mkIf cfg.enable {
    services.resolved = {
      enable = true;
      settings.Resolve = {
        Domains = ["az-group.local"];
        FallbackDNS = ["9.9.9.9" "1.1.1.1"];
        LLMNR = "no";
        MulticastDNS = "no";
      };
    };

    # NetBird hooks into resolved via its own daemon (no extra config here).
  };
}