Publish DHCP clients' names in DNS

router-webui leases-dns reads Kea's leases and publishes <name>.<domain>
with reverse records in the running Unbound (router.dns.dynamicLeases).
Names the configuration publishes are never taken over; a client's name
is cut to its first label and kept inside the local domain; of two
clients the newer lease wins. The DNS page switches it on and shows what
is published and what was skipped; router-setup enables it with a domain.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/settings/default.nix

@@ -190,6 +190,37 @@ in
       };
     };
 
+    # The DHCP clients' names in DNS (router.dns.dynamicLeases): reads Kea's
+    # leases and publishes them in the running Unbound.
+    systemd.services.router-leases-dns = lib.mkIf (config.router.enable && config.router.dns.dynamicLeases) {
+      description = "Publish DHCP clients' names in DNS";
+      wantedBy = [ "multi-user.target" ];
+      after = [
+        "unbound.service"
+        "kea-dhcp4-server.service"
+      ];
+      path = [ config.services.unbound.package ];
+      serviceConfig = {
+        ExecStart = "${lib.getExe webui} leases-dns -leases /var/lib/kea/dhcp4.leases -static /etc/router/dns-static.json -socket ${config.services.unbound.localControlSocketPath} -run /run/router-leases-dns";
+        RuntimeDirectory = "router-leases-dns";
+        Restart = "always";
+        RestartSec = 5;
+        # It reads leases and talks to Unbound's socket; nothing else.
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateNetwork = true;
+        PrivateDevices = true;
+        NoNewPrivileges = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+      };
+    };
+
     # Rebuilding on the device must work without internet (the uplink may be
     # what is being configured). What a changed configuration rebuilds is all
     # generated by NixOS, but those builds need these packages; found by