.:53 {
    errors
    health {
        lameduck 5s
    }
    ready
    log . {
        class error
    }
    prometheus :9153

    # VPN access: map api-server.cluster.local to the cluster API service.
    rewrite name api-server.cluster.local kubernetes.default.svc.cluster.local

    # Forgejo: route through nginx ingress (TLS on :443, /v2/ registry + web).
    # Do NOT point at forgejo-gitea-http directly (port 3000 only) — image pulls
    # use https/:443 and would time out. SSH stays on its own LB service.
    rewrite name forgejo.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name git.riotpiao.com forgejo-gitea-ssh.cicd.svc.cluster.local

    # Homelab hostnames -> nginx ingress controller so in-cluster pods hit nginx
    # TLS termination (cert-manager cert) and preserve the Host header. Routing
    # via nginx (not the backend service) is critical: a direct rewrite bypasses
    # nginx TLS and exposes each app's own self-signed cert, trusted by nothing.
    rewrite name authentik.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name grafana.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name minio.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name minio-api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name argocd.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name vault.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name loki.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name prometheus.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name homarr.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name portainer.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    rewrite name longhorn.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
    # Kong API gateway. Points at nginx, not kong-proxy, for the same reason as
    # the rest: a direct rewrite would skip TLS termination. Pods that don't
    # need TLS should call kong-proxy.api.svc.cluster.local instead of using
    # this name at all.
    rewrite name api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local

    kubernetes cluster.local in-addr.arpa ip6.arpa {
        pods insecure
        fallthrough in-addr.arpa ip6.arpa
        ttl 30
    }
    forward . 8.8.8.8 1.1.1.1 {
       max_concurrent 1000
    }
    cache 30 {
       disable success cluster.local
       disable denial cluster.local
    }
    loop
    reload
    loadbalance
}