dns: fixed 1.1.1.1/8.8.8.8 lockdown + scoped mDNS, esphome sibling container

- deploy.conf: DNS_RESOLVERS, always 1.1.1.1/8.8.8.8, never a WAN's own
  DHCP/RA-provided servers (previously whatever Wapana handed out).
- ap/99-van-router-dns.conf: global resolved config (fixed DNS, Domains=~.,
  global MulticastDNS=yes — a prerequisite for any per-link mDNS to work at
  all, not just an on/off toggle).
- failover/60-van-wan-dns: NM dispatcher that strips each WAN's DNS/search-
  domain and disables its mDNS via resolvectl on every connect/lease event
  (NM's own ipv4/ipv6.ignore-auto-dns can't be set as a config-file default —
  confirmed rejected as an unknown key — so this enforces it directly
  instead), retried over ~5s to beat NM's own async DNS commit. Also logs
  what each WAN advertised, never used, to /run/van-wan-dns/.
- ap/21-van-br0.network: MulticastDNS=yes, scoped to the van's own LAN only
  — .local/mDNS now resolves for ESPHome and other LAN devices without
  leaking mDNS onto Wapana/Starlink/cellular.
- dns/: ZeroTier-managed DNS (zt.wrede.pvt) made reproducible — installed
  the official zerotier-systemd-manager package (verified against upstream
  checksums), additive to the above so *.zt.wrede.pvt keeps resolving over
  the overlay independent of WAN.
- ha/esphome.container: ESPHome dashboard as a sibling Podman Quadlet to
  Home Assistant, same host-network/config-volume pattern.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy.sh

@@ -22,6 +22,7 @@ render() {  # render <file> -> stdout, with @TOKEN@ placeholders substituted
         -e "s|@LAN_USB_IFACE@|$LAN_USB_IFACE|g" \
         -e "s|@STARLINK_IFACE@|$STARLINK_IFACE|g" \
         -e "s|@MODEM_USB_VENDOR@|$MODEM_USB_VENDOR|g" \
+        -e "s|@DNS_RESOLVERS@|$DNS_RESOLVERS|g" \
         "$1"
 }
 install_rendered() {  # install_rendered <src> <dst> [mode]
@@ -104,6 +105,26 @@ install -D -m0644 ap/regdomain.service      /etc/systemd/system/regdomain.servic
 install -D -m0644 ap/rtw89.conf             /etc/modprobe.d/rtw89.conf
 install -D -m0644 ap/99-van-router.conf     /etc/sysctl.d/99-van-router.conf
 
+echo "== dns =="
+# Fixed upstream resolvers (deploy.conf's DNS_RESOLVERS), never a WAN's own
+# DHCP/RA-provided DNS — see the files themselves for the full rationale.
+# (NM's ipv4/ipv6.ignore-auto-dns can't be set as a config-file connection
+# default — NM rejects it there — so 60-van-wan-dns enforces this directly
+# against resolved instead, on every WAN connect/lease event.)
+# .local (mDNS) is handled separately, scoped to br0 (see 21-van-br0.network
+# above). ZeroTier-managed DNS (zt.wrede.pvt) is a separate, additive path.
+install_rendered ap/99-van-router-dns.conf  /etc/systemd/resolved.conf.d/99-van-router-dns.conf
+install -D -m0755 failover/60-van-wan-dns   /etc/NetworkManager/dispatcher.d/60-van-wan-dns
+# ZeroTier-managed DNS for zt.wrede.pvt (see README's "ZeroTier managed DNS").
+# allowDNS on the network + the search-domain drop-in are repo-tracked so a
+# reimage doesn't need the manual `zerotier-cli set ... allowDNS=1` step
+# remembered by hand; the manager binary itself is a hand-installed .deb
+# (not in apt) — see https://github.com/zerotier/zerotier-systemd-manager/releases.
+install -D -m0600 dns/zt-network.local.conf /var/lib/zerotier-one/networks.d/d3ecf5726d041b2a.local.conf
+install -D -m0644 dns/zt-search.conf        /etc/systemd/network/99-ztuga7c2kh.network.d/search.conf
+dpkg -s zerotier-systemd-manager >/dev/null 2>&1 \
+    || warn "zerotier-systemd-manager not installed — zt.wrede.pvt won't resolve. Install the arm64 .deb from https://github.com/zerotier/zerotier-systemd-manager/releases"
+
 echo "== failover =="
 install -D -m0755 failover/van-failover         /usr/local/sbin/van-failover
 install -D -m0644 failover/config.json          /etc/van-failover/config.json
@@ -177,6 +198,10 @@ echo "== home assistant =="
 # deploy never bounces HA — after editing the .container, restart it manually.
 install -D -m0644 ha/homeassistant.container /etc/containers/systemd/homeassistant.container
 install -d -m0755 /srv/homeassistant
+# ESPHome dashboard (sibling container, same rationale as HA above — no
+# Supervisor/add-on store here).
+install -D -m0644 ha/esphome.container /etc/containers/systemd/esphome.container
+install -d -m0755 /srv/esphome
 
 echo "== hardware watchdog =="
 install -D -m0644 power/10-vanlink-watchdog.conf /etc/systemd/system.conf.d/10-vanlink-watchdog.conf
@@ -187,6 +212,11 @@ systemctl daemon-reload
 # Re-exec PID1 so the system.conf.d watchdog drop-in takes effect (daemon-reload
 # alone does NOT re-arm RuntimeWatchdogSec). Safe online.
 systemctl daemon-reexec
+# Safe online: picks up 99-van-router-dns.conf immediately. NM's
+# ignore-auto-dns only takes effect on a connection's next activation though —
+# an already-up WAN keeps its currently-applied DNS until it reconnects (or
+# reboot), deliberately not forced here (reconnecting a WAN flaps it).
+systemctl restart systemd-resolved
 # networkd here owns only the AP radios + bridge + wired LAN port (no real uplink);
 # its wait-online would just stall network-online.target. NM-wait-online covers WANs.
 systemctl mask systemd-networkd-wait-online.service >/dev/null 2>&1 || true
@@ -195,6 +225,7 @@ systemctl enable regdomain.service hostapd hostapd-2g van-ap-dnsmasq nftables sy
 # bluetooth: host BlueZ serves the onboard hci0 to the HA container over D-Bus
 systemctl enable --now bluetooth >/dev/null 2>&1 || true
 systemctl start homeassistant || warn "homeassistant failed to start (podman/quadlet — check journalctl -u homeassistant)"
+systemctl start esphome || warn "esphome failed to start (podman/quadlet — check journalctl -u esphome)"
 systemctl restart van-thermal
 systemctl restart van-gps-owntracks
 # Pick up unmanaged-devices changes so NM releases/keeps the right interfaces.