Private routes and DNS

Use role: private-network. Static routes and DNS-learned addresses take precedence over every device’s default egress.

`tunnels[].routes[]`

Type: array of CIDR strings
Required: No
Default: Empty array
Validation: Every value must be a network prefix; no two tunnel routes may overlap.
Secret classification: No; private topology metadata.
Side effects: Adds destinations to a per-tunnel nftables set and policy route.
Minimal example: routes: [10.20.0.0/16]

`tunnels[].dns_servers[]`

Type: array of IP strings
Required: When dns_zones is non-empty
Default: Empty array
Validation: Every item must parse as an IP address.
Secret classification: No; private topology metadata.
Side effects: Starts a forwarder inside this tunnel namespace for private-zone queries.
Minimal example: dns_servers: [10.20.0.53]

`tunnels[].dns_zones[]`

Type: array of domain strings
Required: No
Default: Empty array
Validation: Safe domain-label syntax; a zone may not overlap a zone owned by another tunnel; requires dns_servers.
Secret classification: No; private naming metadata.
Side effects: Forwards matching queries privately and adds answers to this tunnel's dynamic nftables set.
Minimal example: dns_zones: [corp.example]

  - id: office
    type: wireguard
    role: private-network
    source: { kind: config, value: secrets/office.conf }
    routes: [10.20.0.0/16]
    dns_servers: [10.20.0.53]
    dns_zones: [corp.example]
    allowed_devices: [laptop]

Public DNS is source-aware across mixed egresses. A laptop assigned to edge-wg sends ordinary DNS through that namespace, while corp.example still goes through office. Disable forced client DoH when relying on this split.

Next: DNS design and Health.