Harden deployment, authentication, firewall and media storage failure paths

services/router.nix

@@ -17,7 +17,8 @@
 
 { config, lib, pkgs, ... }:
 let
-  portsData = builtins.fromTOML (builtins.readFile ../ports.toml);
+  portsData = (import ./validate-forwards.nix { inherit lib; })
+    (builtins.fromTOML (builtins.readFile ../ports.toml));
   destDefault = portsData.dest_default;
 
   devices = (builtins.fromTOML (builtins.readFile ../devices.toml)).device or [ ];
@@ -95,6 +96,13 @@ let
     (f: ''iifname "eno1" ${f.proto} dport ${f.port} accept comment "${f.name}"'')
     forwards;
 
+  # Docker also creates DNAT rules. A DNAT flag alone is not permission to
+  # enter from WAN: check the published/original port, before translation.
+  # The declared Pelican allocation range remains automatic for new servers.
+  wanPortForwardRules = lib.concatMapStringsSep "\n            "
+    (f: ''iifname "eno1" ct status dnat meta l4proto ${f.proto} ct original proto-dst ${f.port} accept comment "${f.name}"'')
+    forwards;
+
 in
 {
   config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
@@ -221,8 +229,8 @@ in
             # etc.). br-* = Docker custom networks, podman* = Podman rootful.
             # pelican0 = wings' bridge; it does not match br-*.
             iifname { "docker0", "br-*", "podman*", "pelican0" } accept
-            # WAN → any port-forward target (LAN host or docker container)
-            iifname "eno1" ct status dnat accept
+            # WAN → explicitly published ports only, including Docker DNAT.
+            ${wanPortForwardRules}
           }
           chain output {
             type filter hook output priority 0; policy accept;