fix: WireGuard clients may use the router's DNS resolver, which runs while WireGuard does, and /remote-access names its addresses for their configuration.

README.md

@@ -115,7 +115,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `site_to_site` | | object | | The site-to-site connections, each a name and an object of the settings below |
 | `p2s` | `enabled` | boolean | `false` | Road-warrior access |
 | `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients |
-| `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the road-warrior and OpenVPN clients are given: `internal`, `external` or `both` |
+| `p2s` | `dns_listen` | string | `internal` | The addresses of the resolver the road-warrior, OpenVPN and WireGuard clients are given: `internal`, `external` or `both` |
 | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
 | `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused |
 | `wireguard` | `listen_port` | integer | `51820` | UDP port |
@@ -872,10 +872,11 @@ deploying.
 which is how a deferred install is expressed. `generic` is the module to choose when the
 router should be configured but the platform adds nothing.
 
-The shipped modules currently add nothing. Road-warrior and OpenVPN clients are given the
+The shipped modules currently add nothing. Road-warrior, OpenVPN and WireGuard clients are given the
 router's addresses of `p2s.dns_listen` as their DNS servers, by default the internal address,
+the WireGuard clients in the configuration the Router Manager makes for a device (`DNS =`),
 where `vpn-router-resolver.service`, dnsmasq with `/etc/vpn-router/dnsmasq.conf`, answers and
-the firewall opens port 53 for the client pools, so no provider resolver has to be advertised or
+the firewall opens port 53 for the client pools and the WireGuard network, so no provider resolver has to be advertised or
 routed through the tunnel on any platform. dnsmasq forwards to `systemd-resolved` on
 127.0.0.53, which keeps only its loopback stubs, and forwards no name without a dot, so the
 router's own host name, `_gateway` and `localhost` are not answered to the clients. The clients reach
@@ -1310,7 +1311,7 @@ OpenVPN (`openvpn`) and WireGuard (`wireguard`), with the same token as `/users`
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /remote-access` | | `{"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}`; `wireguard_server` is `{"public_key", "endpoint", "allowed_ips"}`: the router's WireGuard public key (`null` before setup made it), `<wan.local_fqdn>:<wireguard.listen_port>` (`null` without a name) and the networks a peer reaches through the tunnel, the router's local CIDRs and the WireGuard network |
+| `GET /remote-access` | | `{"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}`; `wireguard_server` is `{"public_key", "endpoint", "allowed_ips", "dns"}`: the router's WireGuard public key (`null` before setup made it), `<wan.local_fqdn>:<wireguard.listen_port>` (`null` without a name), the networks a peer reaches through the tunnel, the router's local CIDRs and the WireGuard network, and the addresses of the remote access clients' resolver (`[]` while it does not run) |
 | `PUT /remote-access/<system>` | any of the settings of the section `p2s`, `openvpn` or `wireguard` | the section |
 
 `running` tells for each system whether setup runs it. IKEv2 and OpenVPN run once enabled with an
@@ -1575,7 +1576,7 @@ missing, without the recommended bind backend.
 
 Records added with `/dns` or the Router Manager (A, AAAA, CNAME, TXT, MX, SRV, CAA) are served
 too, but not those of a name and type the zone's own records have. Setup writes the zone at each
-run; the SOA's serial grows only when the records change. While P2S or OpenVPN is enabled,
+run; the SOA's serial grows only when the records change. While P2S, OpenVPN or WireGuard is enabled,
 dnsmasq answers their clients on port 53 of the addresses of `p2s.dns_listen`, by default the
 internal address, so `dns.listen` must not share an interface with it. The parent zone must delegate `dns.zone` to `dns.nameserver`, with glue records for
 a name server inside the zone.