# Managed by pxe_server_setup.yml (vars pxe_nic_name, corp_nic_name).
# Pin dnsmasq to the imaging NIC. Without it the box offers PXE/DHCP on the
# GE corporate LAN the moment that cable is plugged in. Works together with
# port=0 / listen-address / bind-dynamic in /etc/dnsmasq.conf and the
# pxe-nic-check guard (docs/pxe-nic-guard.md).
interface={{ pxe_nic_name }}
{% if corp_nic_mac %}
except-interface={{ corp_nic_name }}
no-dhcp-interface={{ corp_nic_name }}
{% else %}
# No pinned GE NIC (corp_nic_mac empty): every other wired port is a DHCP
# client with no fixed name. interface= alone keeps dnsmasq off them, and
# its only dhcp-range is the imaging subnet, so a GE address matches none.
{% endif %}