Harden NOMAD Pi-hole DNS binding

docs/planning/DEPLOY_PIHOLE.md

@@ -263,7 +263,8 @@ services:
     environment:
       TZ: ${TZ}
       FTLCONF_webserver_api_password: ${PIHOLE_PASSWORD}
-      FTLCONF_dns_listeningMode: "LOCAL"
+      FTLCONF_dns_interface: "enp5s0"
+      FTLCONF_dns_listeningMode: "SINGLE"
       FTLCONF_dns_upstreams: "127.0.0.1#5335"
       FTLCONF_webserver_port: "8954"
       FTLCONF_ntp_ipv4_active: "false"
@@ -287,6 +288,20 @@ services:
       - ./keepalived.conf:/container/environment/01-custom/keepalived.conf
 ```
 
+### NOMAD host prerequisite
+
+If `systemd-resolved` is holding a local DNS stub on port 53, disable it before relying on NOMAD Pi-hole for LAN DNS:
+
+```bash
+sudo mkdir -p /etc/systemd/resolved.conf.d
+cat <<'EOF' | sudo tee /etc/systemd/resolved.conf.d/99-pihole.conf
+[Resolve]
+DNSStubListener=no
+EOF
+sudo systemctl restart systemd-resolved
+sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
+```
+
 ### keepalived.conf (N.O.M.A.D. — BACKUP1)
 
 ```