base:
  dom0:
    - match: nodegroup
    - dnscrypt.clone