{
  "_purpose": "Source of truth for DNS records served to the wg1 mesh by apricot's dnsmasq (instance bound to 10.9.0.2:53). Consumed by bin/wg-dns-sync.",
  "_consumers": ["bin/wg-dns-sync"],
  "_dnsmasq_address_syntax": "Leading dot in 'name' = wildcard match for the domain and any subdomain. No leading dot = exact match only.",
  "listen_address": "127.0.0.1,10.9.0.2",
  "records": [
    {
      "name": ".apricot.local",
      "ip": "10.0.0.116",
      "comment": "apricot's primary LAN IP (eno2). Covers apricot.local plus all *.apricot.local subdomains used by lilith-platform nginx vhosts."
    },
    {
      "name": ".atlilith.local",
      "ip": "10.0.0.116",
      "comment": "atlilith.local TLD also served by apricot's lilith-dev-nginx (api, imajin, minio, search, stream-api)."
    },
    {
      "name": ".black.local",
      "ip": "10.0.0.11",
      "comment": "black's LAN IP (forge.black.local). Covers black.local and all subdomains."
    }
  ]
}