MagicDNS is broken in the container (DNS proxy returns SERVFAIL with 'no upstream resolvers set'). Use extra_hosts as a reliable workaround to ensure ollama.lan.poldebra.me resolves to its Tailscale IP 100.64.0.7 instead of the server's public IP which has an expired cert.