nixserve: stop Tailscale from hijacking DNS resolution

Tailscale's stub resolver (100.100.100.100) intermittently times out
or SERVFAILs under bursty concurrent lookups (a known upstream issue,
e.g. tailscale/tailscale#6850, #10768, #8829), which was breaking HACS
updates in the Home Assistant container (network_mode: host, so it
inherits nixserve's own resolv.conf). Point nixserve at the local
Pi-hole instead and disable Tailscale's accept-dns so it can't
override it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flake.lock

@@ -8,11 +8,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1791759048,
+        "lastModified": 1792105523,
-        "narHash": "sha256-/KMQbdh5X6Sa1GTUqyKf3vHdHDgpuRfJr9iHommwiH8=",
+        "narHash": "sha256-DGj+1Z+3zHwyi+Wh6SQqY1ya9kUElF1xVNg3V054X0s=",
         "owner": "ogulcancelik",
         "repo": "herdr",
-        "rev": "dc6b6e5f42831ea7114f34dcf12900680eb36ae0",
+        "rev": "143bf5fd4781d164260c63fe28e7dc08054ad32f",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1790996401,
+        "lastModified": 1792438572,
-        "narHash": "sha256-f+kOxEmOUnQazVAmGg0i8hzwgd1kX/geY+k/Dpheye8=",
+        "narHash": "sha256-5mQQOcggBRBXB7NlzUxO0dbvQN4euJOISjNybrtfxPk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "db7d5e2332710f5abb088f6b5de927d7f9511b35",
+        "rev": "24f8f8e786f87d6a818e1746cb2389bf922afdab",
         "type": "github"
       },
       "original": {
@@ -44,11 +44,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1791662279,
+        "lastModified": 1792503283,
-        "narHash": "sha256-tM6MAMxVwetta6uD2aMzoWQ9v5EAaLLmYumiE4jVZeg=",
+        "narHash": "sha256-OtQ9jaQ9aXZDm61TqykPLZdXJa2NMykYG3d0tbT683U=",
-        "rev": "6fcc160353f63555b560f25588925133c8f61f2a",
+        "rev": "cd4ea8d57de16f4810bc5f14207bac45fbf19f67",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.11680.6fcc160353f6/nixexprs.tar.zst"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.12297.cd4ea8d57de1/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",

hosts/nixserve/default.nix

@@ -9,6 +9,11 @@
   networking.hostName = "nixserve";
   networking.hostId = "941b956b";
   networking.networkmanager.enable = true;
+  # nixserve's own DNS lookups (e.g. HACS/docker pulls) go to the local Pi-hole
+  # first instead of detouring through Tailscale's DNS proxy -> home router,
+  # which was timing out under HACS's bursty concurrent lookups. Tailscale's
+  # MagicDNS resolver (100.100.100.100) stays as a fallback nameserver.
+  networking.nameservers = [ "127.0.0.1" ];
 
   boot.supportedFilesystems = [ "zfs" ];
   boot.zfs.forceImportRoot = false;

hosts/nixserve/services.nix

@@ -67,6 +67,12 @@ in
     enable = true;
     openFirewall = true;
     useRoutingFeatures = "server";
+    # Don't let Tailscale take over nixserve's own DNS resolution: its stub
+    # resolver (100.100.100.100) intermittently times out under bursty lookups
+    # (a known upstream issue, e.g. tailscale/tailscale#6850, #10768, #8829),
+    # which broke HACS updates. nixserve resolves via local Pi-hole instead
+    # (see networking.nameservers in hosts/nixserve/default.nix).
+    extraSetFlags = [ "--accept-dns=false" ];
   };
 
   services.syncthing = {