1{lib, ...}: {
 2  den.aspects.services.direct-dns = {
 3    settings.host = {
 4      mode = lib.mkOption {
 5        type = lib.types.nullOr (lib.types.enum ["direct" "tailscale"]);
 6        default = null;
 7        description = ''
 8          Default connection policy for reverse proxy domains served by this host.
 9
10          - `null`: resolve through public DNS (unchanged).
11          - `"direct"`: resolve to the host's public IP.
12          - `"tailscale"`: resolve to the host's tailscale IP.
13
14          Individual reverse proxy entries can override this with `prefer`.
15        '';
16      };
17    };
18  };
19}