# Host Resolver Baseline

Use this file when the host uses Tailscale DNS or another specialized resolver
that should not be copied directly into Bastille jails.

## Problem shape

The host may legitimately use:

```conf
nameserver 100.100.100.100
```

through Tailscale MagicDNS.

Real observed shape on this host:

```conf
# Generated by resolvconf
search taile682b7.ts.net openstacklocal
nameserver 100.100.100.100
```

That does not make it a good default resolver file for Warden VNET jails.

## Recommended split

- host keeps its own resolver model
- Bastille jails use a dedicated resolver file

Recommended file:

```sh
/usr/local/etc/bastille/resolv.conf
```

Recommended contents:

```conf
nameserver 1.1.1.1
nameserver 9.9.9.9
```

Then set:

```sh
bastille_resolv_conf="/usr/local/etc/bastille/resolv.conf"
```

in `/usr/local/etc/bastille/bastille.conf`.

## Why

- avoids leaking host-specific DNS assumptions into jails
- keeps jail network debugging simpler
- avoids treating a host Tailscale resolver as a jail prerequisite
