fix(podman): pin aardvark-dns to 1.17.1 from stable

aardvark-dns 2.0.0 has a DNS forwarding bug breaking external name
resolution in podman networks. Pin to 1.17.1 (last 1.x) from
nixpkgs-stable; the nixpkgs podman wrapper picks it up via helpersBin
automatically.

hosts/common/default.nix

@@ -32,7 +32,7 @@
     overlays = [
       # Add overlays your own flake exports (from overlays and pkgs dir):
       #outputs.overlays.additions
-      #outputs.overlays.modifications
+      outputs.overlays.modifications
       outputs.overlays.stable-packages
       # outputs.overlays.locked-packages
       # outputs.overlays.pinned-packages

overlays/default.nix

@@ -7,22 +7,10 @@
   # This one contains whatever you want to overlay
   # You can change versions, add patches, set compilation flags, anything really.
   # https://nixos.wiki/wiki/Overlays
-  modifications = _final: _prev: {
-    #   n8n = import ./mods/n8n.nix {inherit prev;};
-
-    #   brave = prev.brave.override {
-    #     commandLineArgs = "--password-store=gnome-libsecret";
-    #     };
-
-    # hyprpanel = inputs.hyprpanel.packages.${prev.system}.default.overrideAttrs (prev: {
-    #   version = "latest"; # or whatever version you want
-    #   src = final.fetchFromGitHub {
-    #     owner = "Jas-SinghFSU";
-    #     repo = "HyprPanel";
-    #     rev = "master"; # or a specific commit hash
-    #     hash = "sha256-l623fIVhVCU/ylbBmohAtQNbK0YrWlEny0sC/vBJ+dU=";
-    #   };
-    # });
+  modifications = final: _prev: {
+    # aardvark-dns 2.x has a DNS forwarding bug breaking external name
+    # resolution in podman networks — pin to last 1.x from nixpkgs-stable.
+    aardvark-dns = import ./mods/aardvark-dns.nix {inherit (final) stable;};
   };
 
   # temp-packages = final: _prev: {

overlays/mods/aardvark-dns.nix

@@ -0,0 +1,12 @@
+# aardvark-dns pinned to the 1.x series.
+#
+# aardvark-dns 2.x has a DNS forwarding bug that breaks resolution of
+# external hostnames in podman networks.  1.17.1 is the last 1.x release
+# and is taken from nixpkgs-stable (nixos-26.05), which ships it together
+# with netavark 1.17.2 — the same netavark version as our unstable input,
+# so this is the exact upstream-tested combination.
+#
+# No further wiring needed: the nixpkgs podman package pulls aardvark-dns
+# in via callPackage and symlinks it into libexec/podman (helpersBin), so
+# overriding the top-level attribute propagates to podman automatically.
+{stable}: stable.aardvark-dns