Jamil

This seems like a good idea. Could you link to where ICE creds are generated in the codebase? My guess is it's trivial to replicate in Elixir. The caveat here...

Merging `main` to get checks to pass

That's for the headless client, what about the Gateway? Seems like we could try some of these workarounds mentioned in the link you sent to see if they're effective: Possible...

I'm probably missing something, but I'm a little confused. I assumed it would work like this: - application sends connlib a query for `foo` - connlib sees that it matches...

Ah, that makes sense now. Unfortunately this seems like it will be much more involved then and require exposing this as a config entry in the portal to send to...

Wait a minute. Does your `/etc/resolv.conf` have a searchDomain present? On macOS at least, if I clear mine, hosts are routed through connlib as expected: ``` jamil@Airbook-Mac:~/Developer/firezone/firezone (jamilbk/fix-rest-api-link$=) % dig...

I can confirm this actually works as expected on macOS today with a systemd gateway with no changes. I don't even need to clear the search domain in /etc/resolv.conf, though...

The issue I fear with setting this in the Client is that it deviates the convention of keeping DNS configuration local to the Gateways. The search domain configuration might need...

Setting a searchDomain in the macOS client will apply it to the DNS configuration when the tunnel comes up. Android has a similar option: https://developer.android.com/reference/android/net/VpnService.Builder#addSearchDomain(java.lang.String) Windows too (@ReactorScram to confirm):...

Resolution for this feature: - Add `searchDomain` config option in portal account DNS settings - Customer will need to define DNS Resource with FQDN - Apply the searchDomain to the...