doc: make every LAN instance static, record the FTTH fallout

Follow-up to a7f1ac6. The Archer C7's DHCP reservations did not carry
over to the FTTH box, so anything still on DHCP was one lease renew away
from moving — as blocky already demonstrated by taking LAN DNS with it.
jellyfin-server and jellyfin-client are now static too; homeassistant
stays dynamic on purpose (it never had a reservation).

Records three things that cost time to find:

- jellyfin-client can never use netplan: the kiosk raw.lxc bind-mounts
  the host /run/udev read-only, so netplan generate fails and config
  silently does not regenerate at boot. It uses systemd-networkd now.
- LAPTOP719974 and patate also lost their reserved addresses.
- ks4 cannot serve as an IPv6 exit: it has a global v6 address and a
  default v6 route but no working v6 egress, so extending the torrent
  tunnel to ::/0 is not an option. IPv6 stays disabled in the container.

Also notes the C7 + LTE box kept as fallback: only the gateway differs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

nas/README.md

@@ -34,7 +34,7 @@ Storage + backup host on the LAN, added 2026-08.
 |---|---|---|---|
 | blocky | 192.168.0.254 | — | unprivileged, autostart; DNS ad-blocker for the LAN. Moved from nuc 2026-08-30 so it survives nuc being powered off |
 | privoxy | 192.168.0.11 | — | unprivileged, autostart; filtering HTTP proxy, listens on **:3128** (not privoxy's default 8118); static config in `/etc/systemd/network/eth0.network` (`Gateway=192.168.0.1`), `DNS=192.168.0.254`. Moved from nuc 2026-08-30 |
-| [transmission-bt](transmission-bt.md) | 192.168.0.7 | ✅ | unprivileged, autostart; always-on WireGuard full tunnel → ks4 (egress = 193.70.35.17, kill switch: no default route in `main`, wg-quick's `fwmark`/`suppress_prefixlength` rules send traffic to table 51820 — **`netplan apply` wipes those rules, so always `systemctl restart wg-quick@wg0` after it**); **IPv6 disabled** (`/etc/sysctl.d/99-no-ipv6.conf`) since the tunnel is `AllowedIPs = 0.0.0.0/0` only and the FTTH box's native IPv6 RA bypassed the kill switch entirely; `/export/media` disk device (`shift=true`), downloads to `/media/downloads`; web UI :9091 (LAN only). Moved from nuc 2026-08-30 |
+| [transmission-bt](transmission-bt.md) | 192.168.0.7 | ✅ | unprivileged, autostart; always-on WireGuard full tunnel → ks4 (egress = 193.70.35.17, kill switch: no default route in `main`, wg-quick's `fwmark`/`suppress_prefixlength` rules send traffic to table 51820 — **`netplan apply` wipes those rules, so always `systemctl restart wg-quick@wg0` after it**); **IPv6 disabled** (`/etc/sysctl.d/99-no-ipv6.conf`) since the tunnel is `AllowedIPs = 0.0.0.0/0` only and the FTTH box's native IPv6 RA bypassed the kill switch entirely. Extending the tunnel to `::/0` is **not currently possible**: ks4 has a global v6 address and a default v6 route but **no working v6 egress** (verified 2026-09-16 — both ICMP and TCP to the v6 internet fail while v4 is fine), so it cannot act as a v6 exit. Fix OVH v6 on ks4 first if v6 peers are ever wanted; `/export/media` disk device (`shift=true`), downloads to `/media/downloads`; web UI :9091 (LAN only). Moved from nuc 2026-08-30 |
 
 ## Backup pools hosted here
 

nuc/nuc-install.md

@@ -167,30 +167,54 @@ the nuc or a sibling container; that always fails by design.)
 
 LAN gateway note: the router/gateway is **`192.168.0.1`** — the FTTH box,
 since 2026-09 (it was `.2`, the Archer C7, from 2026-08; and `.1` before
-that). **Every statically-configured host and instance must be updated by
+that). **Every host and instance is statically configured, so each one
-hand**, and DHCP ones need a lease renew before they stop using the cached
+must be updated by hand.** Symptom of a missed one: the service is up and
-old gateway. Symptom of a missed one: the service is up and its port
+its port answers, but nothing it fetches works.
-answers, but nothing it fetches works.
 
-Static holdouts to update on any gateway change — the full list, verified
+Every LAN host and instance is now **statically configured** (verified
-2026-09-16:
+2026-09-16) — nothing on this LAN depends on a DHCP reservation any more.
+On a gateway change, update all of these by hand:
 
-| Where | What to change |
+| Where | File | Address |
-|---|---|
+|---|---|---|
-| nas host | `/etc/network/interfaces`, `gateway` |
+| nas host | `/etc/network/interfaces`, `gateway` | `.4` |
-| nuc host | `/etc/network/interfaces`, `gateway` |
+| nuc host | `/etc/network/interfaces`, `gateway` | `.3` |
-| blocky | `/etc/systemd/network/eth0.network`, `Gateway=` (static since 2026-09, see below) |
+| blocky | `/etc/systemd/network/eth0.network`, `Gateway=` | `.254` |
-| privoxy | `/etc/systemd/network/eth0.network`, `Gateway=` |
+| privoxy | `/etc/systemd/network/eth0.network`, `Gateway=` | `.11` |
-| transmission-bt | netplan `routes: via:` (the WG kill-switch `/32`) |
+| transmission-bt | netplan `routes: via:` (WG kill-switch `/32`) | `.7` |
-| jellyfin-server/-client | DHCP — renew the lease, or they keep the old gateway |
+| jellyfin-server | netplan `routes: - to: default / via:` | `.5` |
+| jellyfin-client | `/etc/systemd/network/10-eth0.network`, `Gateway=` | `.6` |
 
-⚠️ **DHCP reservations did not survive the FTTH migration.** blocky held
+`homeassistant` (a HAOS **VM**, NetworkManager, normally stopped) is
-`192.168.0.254` via a reservation on the Archer C7; renewing its lease on
+deliberately left on DHCP — it never had a reservation and nothing
-the FTTH box handed it a random address and took LAN DNS down with it. It
+addresses it by IP.
-is now **statically configured** so it cannot move. `jellyfin-server`
+
-(`.5`) and `jellyfin-client` (`.6`) are still DHCP with stale leases — set
+⚠️ **Why everything is static now: DHCP reservations did not survive the
-reservations on the FTTH box or make them static before those leases
+FTTH migration.** They lived in the Archer C7's `dhcp.@host[-1]` list
-expire.
+(the `add_host` block in
+[../archer-c7/upgrade-openwrt-25.12.md](../archer-c7/upgrade-openwrt-25.12.md)),
+and the FTTH box did not inherit them. blocky held `192.168.0.254` that
+way; renewing its lease handed it a pool address and took LAN DNS down
+with it. Static config removes the dependency entirely.
+
+Two **non-container** hosts also lost their reservations and are still
+dynamic — harmless, nothing addresses them by IP, but the old fixed
+addresses are gone: `LAPTOP719974` (was `.20`) and `patate` (was `.21`).
+
+⚠️ **`jellyfin-client` cannot use netplan at all.** It is a privileged
+kiosk whose `raw.lxc` bind-mounts the host's `/run/udev` read-only, so
+`netplan generate` dies with `cannot create directory /run/udev/rules.d`
+— which means netplan changes there **silently fail to regenerate at
+boot**. It is configured with plain systemd-networkd
+(`/etc/systemd/network/10-eth0.network`); its old netplan yaml is parked
+at `/root/10-lxc.yaml.netplan-disabled-ftth`. Always verify a network
+change in that container with `incus restart jellyfin-client`, not just
+`netplan apply`.
+
+**Fallback hardware:** the Archer C7 and the LTE box are kept on the
+shelf. Their addressing does not clash with the current LAN — **the
+gateway is the only thing that differs**, so failing back means walking
+the table above and setting `.2` (C7) instead of `.1`.
 
 Let `julien` run harmless incus commands (list/info/config/show…)
 without a password — mutating ones (`exec`, `start/stop`, `delete`)