feat(deploy): Jellyfin at home, published through WireGuard (ADR 0032)

The instance serves jellyfin.halkyon.eu and its Caddy proxies through a
WireGuard tunnel to a Jellyfin on the operator's own machine, which dials
out, so nothing names the home network's address and its router opens no
port. compose.jellyfin-home.yaml takes the sidecar's place, with its
site's rules unchanged (jellyfin.caddy's upstream is now a setting), and
leaves JELLYFIN_URL unset, so the instance suggests it only while it
answers.

On the instance's server the tunnel reaches Jellyfin from Caddy alone and
nothing of the host (wg-jellyfin-rules.sh, set and removed with the
tunnel); the CI runner's unit denies it, and CI's Sandbox step fails if a
job reaches it. The home end keeps Jellyfin in WireGuard's network
namespace, its port on the loopback alone. The steps are in
deploy/sidecars/README.md, the rules held by test/deploy/jellyfin_home_test.dart.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

deploy/home-jellyfin/server/wg-jellyfin-rules.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+# The rules around the tunnel to Jellyfin at home (ADR 0032, D5), set by wg-quick as
+# the tunnel comes up and taken away as it goes (wg-jellyfin.conf), so they live
+# exactly as long as it: `wg-jellyfin-rules.sh up|down <interface>`. As
+# /etc/wireguard/wg-jellyfin-rules.sh on the instance's server (root, 0700).
+#
+# - Forwarded (Docker's DOCKER-USER, before Docker's own rules): into the tunnel only
+#   Caddy (172.30.80.2, its fixed address on edge) to Jellyfin (10.61.96.2:8096), out
+#   of it only the replies; everything else dropped. Docker then masquerades Caddy's
+#   requests as the tunnel's 10.61.96.1, which the home end sees as its proxy.
+# - To the host itself (INPUT): only replies from the tunnel, so the home end reaches
+#   neither sshd nor anything else listening here.
+#
+# IPv4 alone: the tunnel carries no IPv6 (D3). Needs Docker's chains, so the tunnel
+# starts after Docker (wg-quick-after-docker.conf).
+
+set -eu
+
+action=$1
+interface=$2
+forward=halkyon-jellyfin-forward
+input=halkyon-jellyfin-input
+
+case "$action" in
+up)
+  iptables -N "$forward"
+  iptables -A "$forward" -i "$interface" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
+  iptables -A "$forward" -o "$interface" -s 172.30.80.2 -d 10.61.96.2 -p tcp --dport 8096 -j RETURN
+  iptables -A "$forward" -j DROP
+  iptables -I DOCKER-USER -i "$interface" -j "$forward"
+  iptables -I DOCKER-USER -o "$interface" -j "$forward"
+
+  iptables -N "$input"
+  iptables -A "$input" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+  iptables -A "$input" -j DROP
+  iptables -I INPUT -i "$interface" -j "$input"
+  ;;
+down)
+  # Whatever is there of it, so a half-made set goes too.
+  iptables -D DOCKER-USER -i "$interface" -j "$forward" 2>/dev/null || true
+  iptables -D DOCKER-USER -o "$interface" -j "$forward" 2>/dev/null || true
+  iptables -F "$forward" 2>/dev/null || true
+  iptables -X "$forward" 2>/dev/null || true
+  iptables -D INPUT -i "$interface" -j "$input" 2>/dev/null || true
+  iptables -F "$input" 2>/dev/null || true
+  iptables -X "$input" 2>/dev/null || true
+  ;;
+*)
+  echo "usage: $0 up|down <interface>" >&2
+  exit 2
+  ;;
+esac