nuc: document LAN gateway migration 192.168.0.1 -> 192.168.0.2

Update host NIC/interfaces (gw + DNS to public 1.1.1.1/9.9.9.9, no
container dependency), fix transmission-bt kill-switch routes, and add a
note that DHCP instances self-heal while static ones (privoxy,
transmission-bt) must be updated by hand. Also spell out the macvlan
test-from-inside/external-host rule.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nuc/nuc-install.md

@@ -12,7 +12,7 @@ How to rebuild the Incus host from scratch if `/dev/sda` (512 GB SSD,
   `usb4t/media` → `/srv/media` (media library)
 - USB: Pioneer USB audio (`08e4:0176`), Logitech Unifying receiver (K400),
   CSCTEK USB Audio and HID
-- NIC: `enp1s0` (static `192.168.0.3/24`, gw `192.168.0.1`)
+- NIC: `enp1s0` (static `192.168.0.3/24`, gw `192.168.0.2`)
 
 ## ⚠️ What dies with sda
 
@@ -87,8 +87,8 @@ allow-hotplug enp1s0
 iface enp1s0 inet static
     address 192.168.0.3
     netmask 255.255.255.0
-    gateway 192.168.0.1
-    dns-nameservers 192.168.0.1 1.1.1.1
+    gateway 192.168.0.2
+    dns-nameservers 1.1.1.1 9.9.9.9
 ```
 
 Restore `/root/.ssh/authorized_keys` (3 keys; one is `id_rsa_claude.pub`
@@ -161,7 +161,17 @@ EOF
 
 Known macvlan quirk: the **host cannot talk to its own instances** (and
 vice versa) over macvlan — management is via `incus exec`, and other LAN
-hosts reach them normally.
+hosts reach them normally. (So test a container's LAN service from inside
+the container or from an external LAN host — never by pinging its IP from
+the nuc or a sibling container; that always fails by design.)
+
+LAN gateway note: the router/gateway is **`192.168.0.2`** (migrated from
+`192.168.0.1`, 2026-08 — `.1` is gone). DHCP-configured instances pick the
+new gateway up automatically; **statically-configured ones must be updated
+by hand.** Current static holdouts: privoxy
+(`/etc/systemd/network/eth0.network`, `Gateway=`) and transmission-bt
+(netplan `routes: via:` + the WG kill-switch `/32`). Symptom of a missed
+one: the service is up and its port answers, but nothing it fetches works.
 
 Let `julien` run harmless incus commands (list/info/config/show…)
 without a password — mutating ones (`exec`, `start/stop`, `delete`)
@@ -258,7 +268,7 @@ Both logs rotate monthly (`/etc/logrotate.d/incus-*`).
 - [ ] Jellyfin web at `http://192.168.0.5:8096`, kiosk UI on HDMI,
       sound on the Pioneer, "Pioneer A-70" visible in Spotify Connect
 - [ ] LAN DNS: clients use blocky at `192.168.0.254` (host itself uses
-      `192.168.0.1` + `1.1.1.1` to avoid a bootstrap loop)
+      public `1.1.1.1` + `9.9.9.9`, never blocky, to avoid a bootstrap loop)
 - [ ] Optional (only if QSV low-power encoders are wanted):
       `echo 'options i915 enable_guc=3' > /etc/modprobe.d/i915.conf
       && update-initramfs -u`

nuc/transmission-bt.md

@@ -57,17 +57,17 @@ network:
         addresses: [192.168.0.254]
       routes:
         - to: 193.70.35.17/32
-          via: 192.168.0.1
+          via: 192.168.0.2
 EOF
 chmod 600 /etc/netplan/10-lxc.yaml
 netplan apply'
 
 # packages need a temporary default route (removed right after)
-incus exec "$CNAME" -- ip route add default via 192.168.0.1
+incus exec "$CNAME" -- ip route add default via 192.168.0.2
 incus exec "$CNAME" -- apt-get update
 incus exec "$CNAME" -- apt-get install -y --no-install-recommends \
     transmission-daemon wireguard-tools iptables curl
-incus exec "$CNAME" -- ip route del default via 192.168.0.1
+incus exec "$CNAME" -- ip route del default via 192.168.0.2
 
 # WireGuard full tunnel (generate key, print pubkey for the ks4 side)
 incus exec "$CNAME" -- bash -c 'umask 077