fix(deploy): nas ingress without source-address allow-lists; keycloak admin paths on their own port #178

Context

On the Phase 0 NAS, published container ports are served by the container runtime's userland proxy. Containers then see the proxy's address, not the client's, and the runtime's DOCKER-USER chain is not consulted; the NAS's per-interface firewall is the control (measured on this NAS 2026-10-11 on another container; to be re-verified here). Caddy's remote_ip allow-lists on the published ingress (Home subnet; workstation-only Keycloak admin paths, ADR-0016 R9.8) would therefore refuse every client, and R9.8 forbids widening them. Container-to-container traffic on the internal networks keeps real addresses, so the back-channel allow-lists are unaffected. #132 (NAS bring-up) depends on this issue.

Decision (Marco, 2026-10-19)

The Keycloak admin paths (/admin/*, /realms/master/*) get their own published port, which the NAS firewall allows only from Marco's workstation (DHCP reservation). Port 8443 never routes them.

Scope

• Re-verify first: on Decisya's stack, record from Caddy's access log which source address a request through the published port shows. If it is the client's after all, keep the remote_ip lists as a second layer; the separate admin port stands either way.
• Caddy: a second listener for the admin paths only, on the id host; the 8443 site blocks stop routing them. Remove the source-address matchers on the published ingress where they cannot work; keep the back-channel ones.
• Compose: publish the admin port on the bind address only, from a required deploy setting (fail-closed when empty), never on all interfaces.
• Guard tests: change the rule that every admitting Caddy matcher has a remote_ip to: back-channel blocks keep it; published blocks are listed with the NAS firewall rule that guards them; the admin paths are never reachable on 8443.
• ADR-0016: amend R9.6 (published ports) and R9.8 (the per-interface firewall as the control; the admin port; why the address lists go). Update the 0.17b2 NAS bring-up: DSM checks, work-window deploy, first F1-F4 measurement #132 runbook steps: firewall rules per interface for 8443 (Home subnet) and the admin port (workstation only), with refusal checks from another Home device and from outside, repeated after every DSM or Container Manager update.

Done when

• The source address is recorded from the stack.
• The admin paths answer only on their own port, and 8443 refuses them.
• Guard tests enforce the new rule, and ADR-0016 is amended.
• 0.17b2 NAS bring-up: DSM checks, work-window deploy, first F1-F4 measurement #132's runbook carries the firewall rules and the refusal checks.

Notes

Full tier (network exposure, admin access, an ADR amendment), with an architect step (G2). Not in the frozen identity paths: the realm is unchanged, and only Caddy routing and Compose change.