# Workstation split-horizon DNS for the k3s PROD cluster.
#
# INSTALL TO: /etc/NetworkManager/dnsmasq.d/20-prod.home.keithjackson.dev.conf
#   NOT /etc/dnsmasq.d/ — the standalone dnsmasq.service is INACTIVE on this workstation. The live
#   resolver is the one NetworkManager spawns (NetworkManager.conf `dns=dnsmasq`), and it reads
#   ONLY --conf-dir=/etc/NetworkManager/dnsmasq.d. A file dropped in /etc/dnsmasq.d/ changes nothing
#   and looks like it should — verify with: pgrep -a dnsmasq
#
# WHY THIS FILE EXISTS
#   The dev profile (10-home.keithjackson.dev.conf) contains:
#       address=/.home.keithjackson.dev/192.168.2.50
#   dnsmasq's `address=` matches the named domain AND EVERY SUBDOMAIN, so that one line also
#   captures the entire `prod.home.keithjackson.dev` tree and answers it with DEV's address. Every
#   prod hostname therefore resolved to dev from this workstation, while Cloudflare correctly
#   returned prod's gateway.
#
#   That failure is deceptive because it PARTIALLY works: dev serves a `*.home.keithjackson.dev`
#   wildcard certificate, which matches `prod.home.keithjackson.dev` (one label) — so the prod apex
#   returns 200 over valid TLS — but NOT `keycloak.prod.home.keithjackson.dev` (two labels), which
#   fails with a certificate-name error. It reads like a broken prod certificate. It is not; it is
#   the wrong server answering. NEVER verify prod's DNS or TLS through this workstation's resolver
#   without confirming these rules are installed.
#
#   dnsmasq resolves `address=` by LONGEST MATCH, so the more specific rules below win over the dev
#   line without editing or reordering it. The dev profile stays untouched.
#
# TOPOLOGY (corrected 2026-09-05 by the operator — the earlier "pfSense override" framing was wrong)
#   The k3s prod cluster is NOT behind pfSense. It sits on the SOHO router network,
#   192.168.2.0/24, which is pfSense's WAN side; pfSense contains 192.168.1.0/24 (the dev LAN).
#   This workstation is on 192.168.2.0/24 too, so it reaches prod's VIPs DIRECTLY — no NAT hop,
#   which is why these addresses are prod's real VIPs and not a forwarded address like dev's
#   192.168.2.50.
#
#   The SOHO router NATs inbound 443 to the pfSense WAN address (192.168.2.102) to serve the
#   EXISTING, NON-K3S production environment. That NAT is untouched by this file: these rules are
#   local to this workstation's resolver only and change nothing about inbound traffic. The legacy
#   prod stays live on 443 until the k3s cutover is deliberately made.

# The prod cluster's shared ingress Gateway (Cilium LB-IPAM; == CILIUM_LB_POOL_START).
# Covers the apex and every service hostname not overridden below.
address=/prod.home.keithjackson.dev/192.168.2.20

# L4 (non-HTTP) services get their OWN LoadBalancer VIPs, so they must NOT be sent to the Gateway.
# These are longer matches than the line above and therefore take precedence.
address=/unifi.prod.home.keithjackson.dev/192.168.2.21
address=/crafty-mc.prod.home.keithjackson.dev/192.168.2.22

# NOTE: no `local=` line is needed. The dev profile's `local=/home.keithjackson.dev/` already stops
# the whole tree — including prod.home.* — from being forwarded upstream.