fix: the remote access clients' resolver answers on the internal address by default, chosen by p2s.dns_listen, so the name server can take port 53 of the external addresses.

ADR.md

@@ -1144,8 +1144,9 @@ Status: Accepted
 Context: Sites get subdomains of a selected domain, delegated to the router, without a registrar
 change per site. Ubuntu has BIND, Knot and PowerDNS; only PowerDNS's gpgsql backend reads records
 from PostgreSQL, so changes are rows, without zone files or reloads. systemd-resolved's stub holds
-127.0.0.53, and its stub on the external addresses answers the remote access clients while P2S or
-OpenVPN is enabled.
+127.0.0.53 and 127.0.0.54, and its extra stub answered the remote access clients on the external
+addresses, the addresses an authoritative server needs. The extra stub answers on the internal
+address just as well, since the clients reach it through the tunnel when it is in `local.cidrs`.
 
 Decision: While `dns.enabled` is true, setup runs `pdns.service` with
 `/etc/powerdns/pdns.d/vpn-router.conf`, written before the packages are installed, on the
@@ -1153,8 +1154,9 @@ addresses of `dns.listen`, with the gpgsql backend on the database `vpn-router-d
 own schema. It writes one zone, `dns.zone`, through the procedure `dns_apply` of
 `/usr/share/vpn-router/sql/dns.sql`: SOA, NS, A and AAAA records of `dns.addresses` for the apex,
 the name server and every site host name in the zone, and manual records administrators add; the
-serial grows only when the records change. `dns.listen` on the external interface is refused while
-P2S or OpenVPN is enabled.
+serial grows only when the records change. The remote access clients' resolver answers on the
+addresses of the new setting `p2s.dns_listen`, by default the internal one; a `dns.listen` that
+shares an interface with it is refused while P2S or OpenVPN is enabled.
 
 Consequences: The zone follows the sites at each setup run. One zone only, without DNSSEC or
 transfers; the delegation is made at the parent zone by hand.