ap: bridge wired LAN port (enx00e04c331140) into br0 with the AP

Add a wired LAN port on the same 10.42.0.0/24 segment as VanLink WiFi by
bridging both into br0. The gateway IP, dnsmasq, and NAT move off the wlan name
onto br0; hostapd (not networkd) enslaves the wlan via bridge=br0, since a
station-mode wlan can't be bridged until it's in AP mode. NM leaves the wired
port unmanaged so networkd owns it. Failover/Starlink (enxd8ec5eeb3512)
untouched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ap/10-van-ap.network

@@ -4,6 +4,9 @@ Name=wlxc83a35a4ee55
 [Link]
 RequiredForOnline=no
 
+# No IP here: the AP wlan is a member of br0, which carries the 10.42.0.1 gateway.
+# hostapd adds this interface to br0 (bridge=br0) after it puts the radio into AP
+# mode — networkd must NOT enslave it (a station-mode wlan can't be bridged), so
+# this file only brings the link up.
 [Network]
-Address=10.42.0.1/24
 ConfigureWithoutCarrier=yes

ap/20-van-br0.netdev

@@ -0,0 +1,10 @@
+# LAN bridge: joins the AP Wi-Fi (added by hostapd, once it's in AP mode) and the
+# wired LAN port (enx00e04c331140, added by networkd) into one 10.42.0.0/24 segment.
+# STP off: only two member ports, no loops, and it avoids the forwarding delay that
+# would otherwise stall the first DHCP handshake on a freshly-plugged client.
+[NetDev]
+Name=br0
+Kind=bridge
+
+[Bridge]
+STP=no

ap/21-van-br0.network

@@ -0,0 +1,12 @@
+# The LAN gateway IP now lives on the bridge, not on the AP wlan (which is just a
+# bridge member). ConfigureWithoutCarrier keeps 10.42.0.1 up even before any wired
+# device is plugged, exactly as it was on the wlan-only setup.
+[Match]
+Name=br0
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Address=10.42.0.1/24
+ConfigureWithoutCarrier=yes

ap/22-van-lan.network

@@ -0,0 +1,11 @@
+# Wired LAN port: enslaved to br0 so anything plugged in lands on 10.42.0.0/24 and
+# gets DHCP/DNS from the same dnsmasq as Wi-Fi clients. NM must leave this device
+# alone (see van-ap-unmanaged.conf) for networkd to own it here.
+[Match]
+Name=enx00e04c331140
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Bridge=br0

ap/hostapd.conf

@@ -1,4 +1,8 @@
 interface=wlxc83a35a4ee55
+# Put the AP into br0 so Wi-Fi and the wired LAN port share one 10.42.0.0/24 segment.
+# hostapd adds the wlan to the bridge after setting AP mode; the bridge itself + its
+# wired member + the gateway IP are defined under /etc/systemd/network (2x-van-br0/lan).
+bridge=br0
 driver=nl80211
 ssid=VanLink
 country_code=CA

ap/nftables.conf

@@ -1,11 +1,26 @@
 #!/usr/sbin/nft -f
 # van-router NAT — masquerade LAN out whatever the WAN of the moment is
-# (anything that is NOT the AP interface: ethernet/Starlink, wifi, future 4G)
+# (anything that is NOT the LAN bridge br0: ethernet/Starlink, wifi, future 4G)
 table ip van_router_nat
 delete table ip van_router_nat
 table ip van_router_nat {
+    chain prerouting {
+        type nat hook prerouting priority dstnat; policy accept;
+        # Expose the Home Assistant VM (on libvirt's NAT net, 192.168.122.50) on the
+        # router's own LAN IP, so VanLink clients reach it at http://10.42.0.1:8123.
+        # The matching FORWARD accept lives in iptables (re-applied by the libvirt
+        # /etc/libvirt/hooks/network hook), since libvirt's reject is in that chain.
+        ip daddr 10.42.0.1 tcp dport 8123 dnat to 192.168.122.50:8123
+    }
     chain postrouting {
         type nat hook postrouting priority srcnat; policy accept;
-        ip saddr 10.42.0.0/24 oifname != "wlxc83a35a4ee55" masquerade
+        ip saddr 10.42.0.0/24 oifname != "br0" masquerade
+        # ZeroTier clients reaching the HA VM via the 10.42.0.1:8123 DNAT: masquerade
+        # them onto virbr0 so HA sees the router (192.168.122.1) and the reply path is
+        # symmetric, exactly like VanLink clients. Matched by ZT ingress interface so it
+        # covers direct members (192.168.196.x) AND the LAN subnets routed in behind other
+        # ZT nodes (192.168.0/6/8/10/13.x). Scoped to virbr0 so ZT<->ZT and ZT->WAN are
+        # untouched.
+        iifname "ztuga7c2kh" oifname "virbr0" masquerade
     }
 }

ap/van-ap-dnsmasq.conf

@@ -1,4 +1,4 @@
-interface=wlxc83a35a4ee55
+interface=br0
 bind-dynamic
 except-interface=lo
 domain-needed

ap/van-ap-unmanaged.conf

@@ -1,2 +1,4 @@
 [keyfile]
-unmanaged-devices=interface-name:wlxc83a35a4ee55
+# The AP wlan and the wired LAN port are both owned by systemd-networkd/hostapd
+# (bridged into br0), so NetworkManager must not touch either of them.
+unmanaged-devices=interface-name:wlxc83a35a4ee55;interface-name:enx00e04c331140