Support RPZ address overrides for local DNS

RPZ A records were parsed as address redirects, but the query pipeline treated the address as a CNAME target and returned the wrong result. Answer IP-literal redirects directly with the matching A or AAAA record, and return NODATA for other query types.

Add the requested EdgeRouter domain overrides as a local RPZ source so each bare owner covers its apex and all subdomains. Mount that source into the pods and document the address-record form. When the Zones page has no existing zone, start the Add Record form in New zone mode and tell the operator to enter its apex.

deploy/k8s/00-config.yaml

@@ -84,6 +84,11 @@ data:
       managed_zones: /var/lib/fancy-dns/managed-zones
       local_zones: [/etc/fancy-dns/zones/*.zone]
       lists:
+        - name: edge-router-x-address-overrides
+          format: rpz
+          path: /etc/fancy-dns/rpz/address-overrides.rpz
+          enabled: true
+          refresh: 0s
         - name: haas
           format: plain
           url: https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

deploy/k8s/07-rpz.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: fancy-dns-rpz
+  namespace: dns
+  labels:
+    app.kubernetes.io/name: fancy-dns
+    app.kubernetes.io/component: address-overrides
+data:
+  address-overrides.rpz: |
+    $TTL 60
+    tornberg.me A 10.10.3.10
+    knatofs.se A 10.10.3.10
+    k6n.net A 10.10.3.10
+    slask.local A 10.10.3.10
+    iamu.dev A 10.10.3.10

deploy/k8s/10-deployment.yaml

@@ -139,6 +139,9 @@ spec:
             - name: zones
               mountPath: /etc/fancy-dns/zones
               readOnly: true
+            - name: rpz
+              mountPath: /etc/fancy-dns/rpz
+              readOnly: true
             - name: tls
               mountPath: /etc/fancy-dns/tls
               readOnly: true
@@ -157,6 +160,10 @@ spec:
           configMap:
             name: fancy-dns-zones
             optional: false
+        - name: rpz
+          configMap:
+            name: fancy-dns-rpz
+            optional: false
         - name: tls
           secret:
             secretName: fancy-dns-tls

deploy/k8s/kustomization.yaml

@@ -12,6 +12,7 @@ resources:
   - 00-config.yaml
   - 05-serviceaccount.yaml
   - 06-zones.yaml
+  - 07-rpz.yaml
   - 10-deployment.yaml
   - 20-service.yaml
   - 30-ingress.yaml