feat(deploy): halkyon.li's forward through ramiel and its host at home (ADR 0039)

ramiel's HAProxy passes halkyon.li's TLS connections, unopened, through a
WireGuard tunnel to the instance at home, with the visitor's address in a
PROXY header, and everything else to ramiel's own Caddy, moved to the
loopback. Each end's nftables table lets the tunnel carry HAProxy's 443 and
the SSH jump's 22 alone, and nothing from home to ramiel.

The host at home: sshd with keys alone, the root disk unlocked over SSH at
boot (dropbear-initramfs, D20), Docker's and containerd's data bind-mounted
from the HDD, and home's end of the tunnel before Docker. An instance behind
the forward (compose.forwarded.yaml) publishes 443 on the tunnel's address
alone, trusts the PROXY header from ramiel alone, and gets its certificates
through TLS-ALPN, without HTTP/3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0039-halkyon-li-at-home.md

@@ -1,6 +1,6 @@
 # ADR 0039: halkyon.li, the family's instance at home, published through ramiel
 
-- **Status:** decided 8 Nov 2026 by the developer: D1 to D6 and D17 to D19 are their
+- **Status:** decided 8 Nov 2026 by the developer: D1 to D6 and D17 to D20 are their
   own choices, D7 to D16 the agent's recommendations, which they confirmed. Nothing is
   built yet. halkyon.li's DNS zone at netcup is in place (D7, checked 8 Nov).
 - **Builds on:** Halkyon Learn's ADR 0021 (a private instance whose operator approves
@@ -116,8 +116,10 @@
 - **D12 balthasar becomes a server**:
   - the desktop no longer starts (`systemctl set-default multi-user.target`, undone by
     `graphical.target`), which frees about 1 GB; Multipass is disabled if unused;
-  - Docker's data moves to the HDD (`data-root` in `/etc/docker/daemon.json`), as the
-    root filesystem has room for no image;
+  - Docker's data moves to the HDD, as the root filesystem has room for no image:
+    `/var/lib/docker` and `/var/lib/containerd` (where Docker 29 keeps images) as bind
+    mounts from `/data`, as `/home` and snapd's folder already are on this machine,
+    rather than Docker's `data-root`, which would leave containerd's store behind;
   - a `deploy` user holds the checkout (`~deploy/halkyon`) and runs the stack, as on
     sahaquiel; the sidecars' user IDs are those of the sidecar README;
   - Caddy publishes 443 on the tunnel's address alone (`10.61.97.2:443`), the tunnel
@@ -169,6 +171,17 @@
   by the polygons, imported by a short-lived Nominatim. The developer raised no
   objection. The console's ADR decides how it runs.
 
+- **D20 balthasar's root disk is unlocked over SSH at boot** (the developer's choice,
+  over Tang on ramiel, which would unlock a stolen machine that is still online, and over
+  typing at the iMac's keyboard alone). Found while writing the host's steps: the root
+  disk is LUKS-encrypted with a passphrase (`/etc/crypttab`: `none`), and the HDD
+  unlocks from a key file on it, so every boot waits for the passphrase.
+  `dropbear-initramfs` waits on the home network at boot, on port 2222 (so its host key
+  never clashes with sshd's in a `known_hosts`). It takes melchior's key alone, which may
+  run nothing but `cryptroot-unlock`. The USB network adapter's driver (`cdc_ncm`) is
+  added to the initramfs. From away, a reboot waits for someone at home, as the tunnel
+  isn't up that early. The keyboard still works as before.
+
 ## Consequences
 
 - People see ramiel's address alone; nothing names the home address, which only ramiel