fix(deploy): the home end dials the instance's server by its address (ADR 0032, D11)

A tunnel that fails to come up takes Jellyfin's internet with it, as
linuxserver/wireguard's client mode deletes the default route. Named by
learn.halkyon.eu, the endpoint needed DNS to come up, which the home end
starting or waking hasn't always got yet; by its address the tunnel comes
up whatever the network does. Closes ADR 0032's open point.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/home-jellyfin/wg0.conf.example

@@ -8,7 +8,11 @@ PrivateKey = <the home end's private key>
 
 [Peer]
 PublicKey = <the instance's public key>
-Endpoint = learn.halkyon.eu:51820
+# learn.halkyon.eu's server by its IPv4 address, not its name (ADR 0032, D11): a name
+# needs DNS to come up, which a machine starting or waking hasn't always got yet, and a
+# tunnel that fails to come up takes Jellyfin's internet with it. A new address of the
+# server's goes here too.
+Endpoint = 89.58.53.154:51820
 # The instance's end alone, through which Caddy's requests come (masqueraded by Docker
 # on the instance's server): nothing else of the internet goes through the tunnel.
 AllowedIPs = 10.61.96.1/32

deploy/sidecars/README.md

@@ -191,7 +191,8 @@ home machine.
    `sudo wg show wg-jellyfin` on the instance's server now shows a handshake.
 
    Whenever `wg0.conf` fails to come up (a placeholder or a wrong key, an endpoint that
-   doesn't resolve), the image's client mode deletes the namespace's default route
+   doesn't resolve: why it names the server by its address, ADR 0032, D11, and a new
+   address of the server's goes there too), the image's client mode deletes the namespace's default route
    (`ip route del default` in its `svc-wireguard/run`, ls126), and Jellyfin with it loses
    the internet: TMDb's metadata and images fail with *Network is unreachable*, and a
    library scanned then gets frames of its videos for posters. A tunnel that comes up