memory: initial import (transferred from wayback) + hub-move and cockpit-EMFILE updates

Snapshot of the Pi 'wan' Claude memory: wayback van-router build notes, ZT DNS,
HA VM, LAN port, and the Pi port memory updated for the 2026-07-06 USB hub move
(AP live on the Pi) and the cockpit-bridge fd-limit fix.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lan-port-and-asymmetric-mgmt-access.md

@@ -0,0 +1,26 @@
+---
+name: lan-port-and-asymmetric-mgmt-access
+description: Wired LAN port bridged into br0; never SSH to 10.42.0.1 from the upstream LAN (asymmetric path drops at ~125s)
+metadata: 
+  node_type: memory
+  type: reference
+  originSessionId: 319a7835-e94a-4021-a56f-dc5714162cf0
+---
+
+Two facts about reaching/managing wayback's LAN side.
+
+**Wired LAN port.** `enx00e04c331140` is now a LAN port, bridged with the AP wlan into
+`br0` (gateway 10.42.0.1/24, dnsmasq DHCP .10–.254). The 10.42.0.1 IP, NAT (`oifname != br0`),
+and dnsmasq all moved off the wlan name onto `br0`. Files in `~/vanlink/ap/`:
+`20-van-br0.netdev`, `21-van-br0.network`, `22-van-lan.network`; hostapd has `bridge=br0`
+(hostapd, not networkd, enslaves the wlan — a station-mode wlan can't be bridged until AP mode).
+Starlink (`enxd8ec5eeb3512`) is untouched and stays the failover WAN.
+
+**Don't SSH to 10.42.0.1 from a host on the 192.168.10.0/24 LAN.** It's the LAN-side gateway IP;
+a request from the upstream LAN comes *in* via ZeroTier (the only route to 10.42.0.0/24) but the
+reply goes *out* `wlp1s0` directly (on-link metric 100 beats the ZT route metric 5000) — asymmetric.
+The SSH session then dies at ~125s because the ZeroTier UDP transport's return-leg conntrack entry
+(`nf_conntrack_udp_timeout_stream = 120`) expires with no return traffic. Confirmed, not worth fixing
+(the connmark policy-routing fix was declined). Instead use DNS that matches location:
+`wayback.lo.wrede.pvt` when local (direct LAN, symmetric, solid) or `wayback.zt.wrede.pvt` when
+remote. See [[zerotier-managed-dns]] and [[wayback-campervan-ap]].