ha: bridge the Home Assistant VM onto br0 as a first-class LAN device

The VM lived on libvirt's default NAT net (192.168.122.50) behind a
/etc/libvirt/hooks/network hook that inserted FORWARD accepts above
libvirt's REJECT. libvirtd restarts re-inserted its chains on top
without firing the hook, silently cutting clients off from HA.

Now the VM's NIC (virtio, was e1000) bridges into br0: pinned lease
10.42.0.50 / name 'homeassistant' via van-ap dnsmasq, mDNS discovery
works, and no firewall hook can rot. Legacy http://10.42.0.1:8123
kept working via DNAT + same-subnet hairpin masquerade. Hook, libvirt
DHCP reservation, and iptables rules removed; domain XML in ha/.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ap/nftables.conf

@@ -6,21 +6,18 @@ delete table ip van_router_nat
 table ip van_router_nat {
     chain prerouting {
         type nat hook prerouting priority dstnat; policy accept;
-        # Expose the Home Assistant VM (on libvirt's NAT net, 192.168.122.50) on the
-        # router's own LAN IP, so VanLink clients reach it at http://10.42.0.1:8123.
-        # The matching FORWARD accept lives in iptables (re-applied by the libvirt
-        # /etc/libvirt/hooks/network hook), since libvirt's reject is in that chain.
-        ip daddr 10.42.0.1 tcp dport 8123 dnat to 192.168.122.50:8123
+        # Home Assistant VM (ha_van) is bridged onto br0 at 10.42.0.50 — clients reach
+        # it directly. Keep the legacy http://10.42.0.1:8123 URL working for anything
+        # that bookmarked it (phones, ZT clients).
+        ip daddr 10.42.0.1 tcp dport 8123 dnat to 10.42.0.50:8123
     }
     chain postrouting {
         type nat hook postrouting priority srcnat; policy accept;
         ip saddr 10.42.0.0/24 oifname != "br0" masquerade
-        # ZeroTier clients reaching the HA VM via the 10.42.0.1:8123 DNAT: masquerade
-        # them onto virbr0 so HA sees the router (192.168.122.1) and the reply path is
-        # symmetric, exactly like VanLink clients. Matched by ZT ingress interface so it
-        # covers direct members (192.168.196.x) AND the LAN subnets routed in behind other
-        # ZT nodes (192.168.0/6/8/10/13.x). Scoped to virbr0 so ZT<->ZT and ZT->WAN are
-        # untouched.
-        iifname "ztuga7c2kh" oifname "virbr0" masquerade
+        # Hairpin for the legacy 10.42.0.1:8123 DNAT when the client sits on the same
+        # subnet as the HA VM: without masquerade the VM would reply directly on br0
+        # from 10.42.0.50 and the client (expecting 10.42.0.1) would drop it. ZT-sourced
+        # traffic doesn't match and doesn't need it — VM replies route back through us.
+        ip saddr 10.42.0.0/24 ip daddr 10.42.0.50 tcp dport 8123 oifname "br0" masquerade
     }
 }

ap/van-ap-dnsmasq.conf

@@ -5,5 +5,8 @@ domain-needed
 bogus-priv
 dhcp-authoritative
 dhcp-range=10.42.0.10,10.42.0.254,255.255.255.0,12h
+# Home Assistant VM (libvirt ha_van, bridged onto br0) — pinned address, resolves
+# as "homeassistant" via this dnsmasq; HAOS also announces homeassistant.local (mDNS).
+dhcp-host=52:54:00:ad:0a:01,10.42.0.50,homeassistant
 dhcp-option=option:router,10.42.0.1
 dhcp-option=option:dns-server,10.42.0.1