fix: dnsmasq answers the remote access clients' DNS queries, so they no longer get the router's own host name with all its addresses from systemd-resolved.

README.md

@@ -402,7 +402,7 @@ firewall rules. It provisions the user directory in `slapd` while OpenVPN or roa
 access is configured. It then starts `strongswan`, `wg-quick@wg0` and
 `openvpn-server@vpn-router` if the corresponding feature is configured, reloading or
 restarting them only when their inputs changed, and
-restarts `systemd-resolved` only when the road-warrior DNS drop-in changed. Turning a
+restarts the remote access clients' resolver only when its configuration changed. Turning a
 feature off in the configuration stops its service and removes its files. Every step is
 idempotent, so restarting with no changes does nothing.
 
@@ -874,9 +874,11 @@ router should be configured but the platform adds nothing.
 
 The shipped modules currently add nothing. Road-warrior and OpenVPN clients are given the
 router's addresses of `p2s.dns_listen` as their DNS servers, by default the internal address,
-where the drop-in `/etc/systemd/resolved.conf.d/p2s-forwarder.conf` makes the router's own
-`systemd-resolved` answer and the firewall opens port 53 for the client pools, so no provider
-resolver has to be advertised or routed through the tunnel on any platform. The clients reach
+where `vpn-router-resolver.service`, dnsmasq with `/etc/vpn-router/dnsmasq.conf`, answers and
+the firewall opens port 53 for the client pools, so no provider resolver has to be advertised or
+routed through the tunnel on any platform. dnsmasq forwards to `systemd-resolved` on
+127.0.0.53, which keeps only its loopback stubs, and forwards no name without a dot, so the
+router's own host name, `_gateway` and `localhost` are not answered to the clients. The clients reach
 the internal address when it is inside `local.cidrs`, which they route through the tunnel. Port 53
 of the other addresses stays free for the name server (see Name server).
 The modules exist as the documented place for platform specifics if that changes.
@@ -1111,8 +1113,8 @@ read at each request:
 | `GET /logs/file?path=<path>&lines=<n>` | `{"lines": [...]}`: the last lines of a file `web.log_files` lists |
 
 The units are the package's own (`vpn-router-setup`, `-web`, `-metrics`, `-pki`, `-backup`,
-`-caddy`), `vpn-router-manager`, `caddy`, `slapd`, `nslcd`, `postgresql`, `strongswan`,
-`wg-quick@wg0`, `openvpn-server@vpn-router` and `ssh`. `lines` is 1 to 1000, 200 without it. A
+`-caddy`, `-resolver`, `-webdav`), `vpn-router-manager`, `caddy`, `slapd`, `nslcd`, `postgresql`,
+`strongswan`, `wg-quick@wg0`, `openvpn-server@vpn-router`, `ssh` and `pdns`. `lines` is 1 to 1000, 200 without it. A
 file is read from at most its last MiB, so very long lines give fewer lines. A unit or a file not
 in the lists is 404, as is a listed file that does not exist.
 
@@ -1574,8 +1576,8 @@ missing, without the recommended bind backend.
 Records added with `/dns` or the Router Manager (A, AAAA, CNAME, TXT, MX, SRV, CAA) are served
 too, but not those of a name and type the zone's own records have. Setup writes the zone at each
 run; the SOA's serial grows only when the records change. While P2S or OpenVPN is enabled,
-systemd-resolved answers their clients on port 53 of the addresses of `p2s.dns_listen`, by default
-the internal address, so `dns.listen` must not share an interface with it. The parent zone must delegate `dns.zone` to `dns.nameserver`, with glue records for
+dnsmasq answers their clients on port 53 of the addresses of `p2s.dns_listen`, by default the
+internal address, so `dns.listen` must not share an interface with it. The parent zone must delegate `dns.zone` to `dns.nameserver`, with glue records for
 a name server inside the zone.
 
 ```sh