Route integration traffic from the Platform through the home-network tunnel #5007

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

• Decision: the VPN bridges into the home network; zero trust protects web access #5001 settles that the WireGuard tunnel is the bridge from the Platform into the home network, so integrations running on the Platform can reach the maintainer's hardware and appliances.
• The server end of the tunnel (feat(talos): WireGuard server listener on control planes (WS3 phase 1) #2462) only listens. Its own comment says that routing tunnel traffic onward is follow-on work, and no issue holds that work. WS3 phase 1b: register the UniFi gateway peer on the control-plane wg0 listener #2473 registers the home gateway as a peer, which lets the tunnel come up, but does not route integration traffic through it.
• The VPN design page (docs(vpn): describe the VPN as the bridge into the home network #5002) lists this piece as "not built" and "not tracked yet".

Audience and problem

The maintainer and any integration that needs a home appliance. With the tunnel up but no route through it, an integration on the Platform still cannot reach the appliance, so the bridge does not deliver its purpose.

Hypothesis

If the Platform sends only the traffic that integrations need through the tunnel, integrations can reach the appliances they need, and nothing else on the home network becomes reachable from the Platform by accident.

Success signal

• An integration on the Platform reaches one named appliance through the tunnel, checked read-only after deployment.
• Guardrail: a destination on the home network that no integration needs is not reachable from the Platform.

Smallest useful change

Design the onward route for one integration first: which Platform workloads may use the tunnel, how their traffic enters it, and how the allow-list of home destinations is kept. Keep the concrete destinations in the private record #5001 describes, not in this repository.

Acceptance criteria

• The routing design is decided and recorded, without private network detail in public files.
• Only workloads that need the bridge can send traffic through it.
• One integration reaches its appliance through the tunnel after deployment, verified read-only.
• The VPN design page's status table links this issue.

Size: medium. Depends on #2473 (the tunnel cannot carry traffic until the gateway is a registered peer).