Proposal: internal DNS — host & upstream name resolution

[fw2568]

Catlet internal names — <hostname>.home.arpa, or <hostname>.<environment>.home.arpa (NetworkConfigRealizer) — exist only as OVN-owned records, resolvable inside the overlay. Nothing resolves them on the Hyper-V host or in upstream DNS. A catlet can't be addressed by its real name from outside, which blocks serving hosted names over TLS, machine certs, and forces localhost:<natport>.

Make the internal name resolvable outside the overlay:

• eryph-zero — eryph runs its own DNS resolver and answers home.arpa on the host.
• enterprise / long-term — no eryph DNS server. A controller hook fires when a catlet gets an IP and pushes the record to the operator's upstream DNS server.

Goals / non-goals

Goals

• Resolve a catlet's internal name on the host (eryph-zero) and via upstream DNS (enterprise).
• One controller hook on catlet IP assign/release — eryph-zero resolver vs. upstream update.
• Keep names short; host/upstream publishing is opt-in.

Non-goals

• eryph as an externally-authoritative DNS server — enterprise pushes into the operator's zone.
• Recursive resolver, caching, forwarding — authoritative-only.

Naming

Keep today's scheme: <hostname>.home.arpa, <hostname>.<environment>.home.arpa. Project is not in the name.

• Per-network opt-in (project network config), default-on in the default project.
• Also gated by provider opt-in — on for build in nat_overlay network default.
• Names are unique per host in case of eryph-zero. A second catlet resolving to the same name is detected at realize/update time; how it is handled (rename / qualify / refuse) is open.

Addressing

nat_overlay gives every catlet a per-catlet floating IP from the provider subnet (default 10.249.248.0/22), wired host↔catlet via dnat_and_snat (UpdateCatletNetworksCommandHandler, ProjectNetworkPlanBuilder). Host-routable on standard ports. The resolver maps name → floating IP.

Mode	IP	Sink
nat_overlay	floating IP (host-local)	eryph-zero resolver
overlay / flat+static	routable, eryph-assigned	upstream update with provider IP and unique name
flat + external DHCP	routable, not eryph-owned	NOT UPDATED

Architecture

• Controller hook on catlet IP assign/release — the controller knows the IP.
• eryph-zero — the hook feeds eryph's own resolver (eryph-zero-only; lives with the controller).
• enterprise — the hook drives an update client against the operator's DNS server.
• Build our own responder — no maintained, permissively-licensed embeddable .NET DNS server exists (ARSoft, kapetan stale; Technitium GPL; DnsClient client-only). Authoritative-only. The same message codec emits update messages, so one wire layer serves both sinks.