fix: LAN split-horizon DNS — TCP proxy on pi (R2)

[etrobert-bot]

Problem

Devices on WiFi (iPhone, macOS, guests) cannot reach
creatures/files/adele/test/umami.etiennerobert.com because:

1. Port-forward block: Vodafone Station CGA6444VF blocks LAN→LAN traffic on
   port-forwarded ports. Ports 80/443 are forwarded to tower .10, so WiFi
   clients cannot reach 192.168.0.10:80/443 directly (port 22 works fine).

2. DNS race condition: iOS queries all DNS servers simultaneously — pi's
   IPv4 DNS (from DHCP) and the Vodafone router's IPv6 RDNSS (from RA). Pi
   returns the tower LAN IP (.10); the router's IPv6 DNS forwards upstream and
   returns 91.64.99.245 (WAN IP). Both paths are blocked (LAN→LAN block, and
   no NAT hairpin, respectively). The router's RDNSS cannot be disabled
   (ISP-locked firmware, no IPv6 LAN config in the UI).

Fix: pi as TCP proxy

Point the domains at pi (192.168.0.18) instead of tower. Pi opens 80/443 and
DNATs to tower (192.168.0.10). The router does not block LAN traffic to pi
(pi is not a port-forward target). Pi's DNS wins the race in practice (answers
from memory vs the router forwarding upstream).

Todo

• modules/lan-dns.nix: change host-record IPs from 192.168.0.10 to
  192.168.0.18; open ports 80/443 on the firewall; add nftables DNAT
  (80/443 → tower .10) + MASQUERADE
• Verify from a WiFi client that the sites load

nftables rules (to add to modules/lan-dns.nix)

networking.nftables.enable = true;
networking.nftables.tables.proxy = {
  family = "ip";
  content = ''
    chain prerouting {
      type nat hook prerouting priority dstnat;
      iifname "${config.services.lanDns.interface}" tcp dport { 80, 443 } dnat to 192.168.0.10
    }
    chain postrouting {
      type nat hook postrouting priority srcnat;
      oifname "${config.services.lanDns.interface}" masquerade
    }
  '';
};

Verification

# From a LAN host over SSH (force resolution to pi):
curl --resolve 'creatures.etiennerobert.com:443:192.168.0.18' https://creatures.etiennerobert.com/
# Should return HTTP 200

# From an iPhone on WiFi: load https://creatures.etiennerobert.com

Status / history

• Tower Ethernet move: DONE (feat(tower): use motherboard NIC with static IP 192.168.0.10 #188). Tower is now on the motherboard NIC
  enp11s0 with static 192.168.0.10 (previously USB enp13s0u1u4u3 at
  .130). host-records currently point at .10, and the port-forward target
  was moved to .10.
• PR feat: static IP on tower, drop dhcp-host from dnsmasq #139 (lan-dns-tower-static-2 — static IP on tower + drop dhcp-host):
  superseded by feat(tower): use motherboard NIC with static IP 192.168.0.10 #188 (which did the same on the motherboard NIC). Close
  without merging.
• PR feat: IPv6 RA on pi for guest-friendly split-horizon DNS #140 (lan-dns-ipv6-ra — IPv6 RA on pi): approach is moot —
  winning the IPv6 DNS race still hands back tower's IPv4, which is blocked by
  the LAN→LAN rule, so it doesn't fix reachability. Close without merging.

Network facts

Router	Vodafone Station CGA6444VF @ 192.168.0.1
WAN IP	91.64.99.245
Pi end0	192.168.0.18 (ULA fd00::18 only, no GUA)
Tower enp11s0	192.168.0.10 (motherboard NIC, static via NetworkManager)
Domains	test/creatures/files/adele/umami.etiennerobert.com