Publish DHCP clients' names in DNS

router-webui leases-dns reads Kea's leases and publishes <name>.<domain>
with reverse records in the running Unbound (router.dns.dynamicLeases).
Names the configuration publishes are never taken over; a client's name
is cut to its first label and kept inside the local domain; of two
clients the newer lease wins. The DNS page switches it on and shows what
is published and what was skipped; router-setup enables it with a domain.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/router/dns.nix

@@ -43,12 +43,23 @@ let
     lib.nameValuePair selfName selfAddrs
   );
 
+  hostRecords = lib.mapAttrsToList (n: a: lib.nameValuePair (fqdn n) a) dns.hosts;
+  reservationRecords = map (r: lib.nameValuePair (fqdn r.name) r.value) reservations;
   records =
     selfRecord
-    ++ lib.mapAttrsToList (n: a: lib.nameValuePair (fqdn n) a) dns.hosts
-    ++ map (r: lib.nameValuePair (fqdn r.name) r.value) reservations
+    ++ hostRecords
+    ++ reservationRecords
     ++ lib.mapAttrsToList (n: a: lib.nameValuePair n a) dns.overrides;
 
+  # What the configuration publishes itself: dynamic names (the clients' host
+  # names, see dns.dynamicLeases) must never take one of these over.
+  staticNames = builtins.toJSON {
+    inherit domain;
+    names = map (r: r.name) (selfRecord ++ hostRecords ++ reservationRecords) ++ map (r: r.name) selfBare;
+    overrides = lib.attrNames dns.overrides;
+    forwardZones = lib.attrNames dns.forwardZones;
+  };
+
   # Unbound reads these as one quoted argument.
   localData = lib.concatMap (r: map (a: ''"${r.name}. ${rrOf a} ${a}"'') r.value) (records ++ selfBare);
   # Reverse records for hosts and reservations (not for wildcard overrides).
@@ -67,8 +78,15 @@ let
 in
 {
   config = lib.mkIf cfg.enable {
+    environment.etc."router/dns-static.json".text = staticNames;
+    warnings = lib.optional (dns.dynamicLeases && domain == null) ''
+      router.dns.dynamicLeases has no effect without router.dns.domain: the clients' names need a domain to live in.
+    '';
+
     services.unbound = {
       enable = true;
+      # What router-webui leases-dns publishes the clients' names through.
+      localControlSocketPath = lib.mkIf dns.dynamicLeases "/run/unbound/unbound.ctl";
       settings = {
         server = {
           interface = [