fix: dnsmasq answers the remote access clients' DNS queries, so they no longer get the router's own host name with all its addresses from systemd-resolved.

ADR.md

@@ -1144,9 +1144,9 @@ Status: Accepted
 Context: Sites get subdomains of a selected domain, delegated to the router, without a registrar
 change per site. Ubuntu has BIND, Knot and PowerDNS; only PowerDNS's gpgsql backend reads records
 from PostgreSQL, so changes are rows, without zone files or reloads. systemd-resolved's stub holds
-127.0.0.53 and 127.0.0.54, and its extra stub answered the remote access clients on the external
-addresses, the addresses an authoritative server needs. The extra stub answers on the internal
-address just as well, since the clients reach it through the tunnel when it is in `local.cidrs`.
+127.0.0.53 and 127.0.0.54, and the remote access clients' resolver answered on the external
+addresses, the addresses an authoritative server needs. The clients reach the internal address
+just as well, through the tunnel when it is in `local.cidrs` (ADR-43).
 
 Decision: While `dns.enabled` is true, setup runs `pdns.service` with
 `/etc/powerdns/pdns.d/vpn-router.conf`, written before the packages are installed, on the
@@ -1160,3 +1160,24 @@ shares an interface with it is refused while P2S or OpenVPN is enabled.
 
 Consequences: The zone follows the sites at each setup run. One zone only, without DNSSEC or
 transfers; the delegation is made at the parent zone by hand.
+
+## ADR-43: The remote access clients' resolver is dnsmasq, not systemd-resolved
+
+Status: Accepted
+
+Context: IKEv2 and OpenVPN clients were given the router as their DNS server, answered by
+systemd-resolved through a `DNSStubListenerExtra` drop-in. resolved synthesizes records for the
+machine's own host name, all its addresses, the Docker bridge and the tunnel addresses included,
+and for `_gateway` and `localhost`, on every stub, and systemd 255 has no setting that turns this
+off. Its extra stub also took port 53 of the addresses PowerDNS needs. dnsmasq-base is in main,
+a single binary without a service of its own, and forwards to one upstream server.
+
+Decision: `vpn-router-resolver.service` runs dnsmasq, bound to the addresses of `p2s.dns_listen`
+only (`bind-interfaces`), forwarding to resolved's stub on 127.0.0.53, without `/etc/hosts` and
+without forwarding names that have no dot (`domain-needed`). resolved keeps its loopback stubs
+only and stays the router's own resolver, with the upstream servers of the platform. Setup writes
+`/etc/vpn-router/dnsmasq.conf` while IKEv2 or OpenVPN runs and removes the earlier drop-in.
+
+Consequences: Clients resolve the names resolved resolves, Azure's internal names included, but
+not the router's synthesized ones. The package depends on dnsmasq-base. PowerDNS and the clients'
+resolver share no address.