--- a/dns.py	Thu Aug 03 14:29:10 2023 -0700
+++ b/dns.py	Sat Aug 12 14:27:14 2023 -0700
@@ -2,37 +2,48 @@
 from pyinfra.operations import apt, files, systemd
 
 
-def dnsmasq_instance(net_name, house_iface, dhcp_range, router, dhcp_hosts_filename='/dev/null'):
+def dnsmasq_instance(net_name,
+                     house_iface,
+                     dhcp_range='10.2.0.10,10.2.0.11',
+                     listen_address='reqd',
+                     dhcp_hosts_filename='/dev/null'):
     files.directory(path=f'/opt/dnsmasq/{net_name}')
-    files.template(src='templates/dnsmasq/dnsmasq.conf.j2',
-                   dest=f'/opt/dnsmasq/{net_name}/dnsmasq.conf',
-                   net=net_name,
-                   house_iface=house_iface,
-                   dhcp_range=dhcp_range,
-                   router=router,
-                   dhcp_enabled=net_name == '10.2' and host.name == 'pipe')
+    files.template(
+        src='templates/dnsmasq/dnsmasq.conf.j2',
+        dest=f'/opt/dnsmasq/{net_name}/dnsmasq.conf',
+        net=net_name,
+        house_iface=house_iface,
+        dhcp_range=dhcp_range,
+        listen_address=listen_address,
+        dhcp_enabled=net_name == '10.2' and host.name == 'pipe',
+        dns_server=listen_address,
+        router=listen_address,
+    )
     files.template(src='templates/dnsmasq/hosts.j2', dest=f'/opt/dnsmasq/{net_name}/hosts', net=net_name)
     files.template(src=dhcp_hosts_filename, dest=f'/opt/dnsmasq/{net_name}/dhcp_hosts', net=net_name)
 
     files.template(src='templates/dnsmasq/dnsmasq.service.j2',
                    dest=f'/etc/systemd/system/dnsmasq_{net_name}.service',
                    net=net_name)
-    if net_name == '10.2':
+    if net_name in ['10.2', '10.2-filtered']:
         systemd.service(service=f'dnsmasq_{net_name}', enabled=True, restarted=True, daemon_reload=True)
 
+
 def standard_host_dns():
     files.template(src='templates/hosts.j2', dest='/etc/hosts')
     files.link(path='/etc/resolv.conf', target='/run/systemd/resolve/resolv.conf', force=True)
     files.template(src='templates/resolved.conf.j2', dest='/etc/systemd/resolved.conf')
     systemd.service(service='systemd-resolved.service', running=True, restarted=True)
 
+
 standard_host_dns()
 
 if host.name == 'bang':
     systemd.service(service='dnsmasq', enabled=False, running=False)
     files.directory(path='/opt/dnsmasq')
 
-    dnsmasq_instance('10.5', house_iface='unused', dhcp_range='unused', router='unused')  # only works after wireguard is up
+    dnsmasq_instance('10.5', house_iface='unused', dhcp_range='unused',
+                     listen_address='unused')  # only works after wireguard is up
 
 elif host.name == 'ditto':
     systemd.service(service='dnsmasq', enabled=False, running=False)
@@ -43,7 +54,7 @@
     dnsmasq_instance('10.2',
                      house_iface='eth1',
                      dhcp_range='10.2.0.101,10.2.0.240',
-                     router='10.2.0.3',
+                     listen_address='10.2.0.3',
                      dhcp_hosts_filename='templates/dnsmasq/dhcp_hosts.j2')
     out = '/opt/dnsmasq/10.2'
     # This mtail is for dhcp command counts and errors. Another monitor in lanscape/ reads the leases file.
@@ -53,5 +64,9 @@
     files.template(src='templates/dnsmasq/dnsmasq-mtail.service.j2', dest=f'/etc/systemd/system/dnsmasq-mtail.service')
     systemd.service(service=f'dnsmasq-mtail', enabled=True, restarted=True, daemon_reload=True)
 
-else:
-    pass
+    # Serve another dns, no dhcp, and include the dynamic-blocking file written by net_routes.
+    dnsmasq_instance(
+        net_name='10.2-filtered',
+        house_iface='eth1',
+        listen_address='10.2.0.4',
+    )

--- a/templates/dnsmasq/dnsmasq.conf.j2	Thu Aug 03 14:29:10 2023 -0700
+++ b/templates/dnsmasq/dnsmasq.conf.j2	Sat Aug 12 14:27:14 2023 -0700
@@ -2,7 +2,7 @@
 keep-in-foreground
 log-facility=-
 
-listen-address={{ router }}
+listen-address={{ listen_address }}
 {% if net == "10.2" %}
 # dnsmasq will not automatically listen on the loopback interface. To achieve
 # this, its IP address, 127.0.0.1, must be explicitly given as a
@@ -37,8 +37,10 @@
 dhcp-leasefile=/opt/dnsmasq/{{ net }}/leases
 dhcp-range={{ house_iface }},10.2.0.0,static,infinite
 dhcp-range=tag:!known,{{ house_iface }},{{ dhcp_range }},2h
-dhcp-option={{ house_iface }},option:dns-server,{{ router }}
+dhcp-option={{ house_iface }},option:dns-server,{{ dns_server }}
 dhcp-option={{ house_iface }},option:router,{{ router }}
+# hosts are tagged in ./dhcp_hosts.j2
+dhcp-option=tag:filtereddns,option:dns-server,10.2.0.4
 {% endif %}
 
 local=/bigasterisk.com/
@@ -54,5 +56,7 @@
 server={{ router }}
 {% endif %}
 
+{% if net == '10.2-filtered' %}
 # written by net_routes/dns_blocker.py
-addn-hosts=/opt/dnsmasq/10.2/dynamic-blocking
+addn-hosts=/opt/dnsmasq/10.2-filtered/dynamic-blocking
+{% endif %}

--- a/templates/dnsmasq/dnsmasq.service.j2	Thu Aug 03 14:29:10 2023 -0700
+++ b/templates/dnsmasq/dnsmasq.service.j2	Sat Aug 12 14:27:14 2023 -0700
@@ -29,18 +29,22 @@
 # 10.5 will not work until wg0 interface is actually up, so just let it retry
 # but i think this next line was not the right way to retry.
 #SuccessExitStatus=2
+Restart=always
+RestartSec=5
 
 # Test the config file and refuse starting if it is not valid.
 ExecStartPre=/usr/sbin/dnsmasq --conf-file=/opt/dnsmasq/{{ net }}/dnsmasq.conf --test
 
 ExecStart=/usr/sbin/dnsmasq --conf-file=/opt/dnsmasq/{{ net }}/dnsmasq.conf 
 
+{% if net == '10.2' %}
 # The systemd-*-resolvconf functions configure (and deconfigure)
 # resolvconf to work with the dnsmasq DNS server. They're called like
 # this to get correct error handling (ie don't start-resolvconf if the 
 # dnsmasq daemon fails to start.
 ExecStartPost=/etc/init.d/dnsmasq systemd-start-resolvconf
 ExecStop=/etc/init.d/dnsmasq systemd-stop-resolvconf
+{% endif %}
 
 ExecReload=/bin/kill -HUP $MAINPID
 

--- a/templates/net/pipe_10.2.network.j2	Thu Aug 03 14:29:10 2023 -0700
+++ b/templates/net/pipe_10.2.network.j2	Sat Aug 12 14:27:14 2023 -0700
@@ -7,7 +7,7 @@
 [Network]
 DHCP=no
 Address=10.2.0.3/16
-# vip for the filtered dns server we give most clients
+# vip for the filtered dns server we give clients who are to have sometimes-filtered domains
 Address=10.2.0.4/16
 DNS=10.2.0.3
 Domains=bigasterisk.com