using coredns to route a split tunnel (like having wireguard connected to home network)

build.sh

#!/bin/sh

git clone https://github.com/coredns/coredns
cd coredns
echo "unbound:github.com/coredns/unbound" >> plugin.cfg
sudo yum install -y unbound-devel
go generate
make
sudo install -T -m 0755 ./coredns /usr/local/sbin/coredns
sudo systemctl enable --now coredns-watcher.path coredns.service

coredns-watcher.path

[Path]
# for when NetworkManager clobbers this file with the resolvers of whatever new network we're on
PathModified=/etc/resolv.conf

[Install]
WantedBy=multi-user.target

coredns-watcher.service

[Unit]
Description=copy the resolver file that NetworkManager landed
Before=coredns.service
After=network-online.target

[Service]
Type=oneshot
ExecStartPre=/bin/bash -c '/bin/cmp /etc/resolv.conf.localhost /etc/resolv.conf || /bin/cp /etc/resolv.conf /etc/resolv.conf.sys'
ExecStart=/bin/cp /etc/resolv.conf.localhost /etc/resolv.conf

coredns.service

[Unit]
Description=local DNS resolver, using coredns
After=network-online.target

[Service]
ExecStart=/usr/local/sbin/coredns -conf /etc/Corefile

Corefile

batts.lan. {
        # i compiled in this unbound plugin, to get recursive lookups. On centos it needed the 'unbound-devel' package.
        unbound
        cache
        forward . 192.168.0.1
        errors
        log
}
 
. {
        unbound
        cache
        forward . /etc/resolv.conf.sys
        errors
        log
}

resolv.conf.localhost

nameserver 127.0.0.1