nftables: let containers reach aardvark-dns

Caddy could not obtain a certificate on first boot: every request to
acme-v02.api.letsencrypt.org timed out. Containers could reach
1.1.1.1:443 by address but resolved no names at all.

Container DNS goes to aardvark-dns on the bridge gateway (10.89.10.1:53).
That traffic terminates on the host, so it takes the input hook, not
forward. Netavark accepts it in its own table, but gitea_filter's input
chain has policy drop, and a packet must be accepted by every base chain
on the hook. Our drop won.

gitea_filter now accepts tcp/udp 53 from the podman subnet to its
gateway. Both come from instance metadata, so the ruleset is rendered
with envsubst, as the fail2ban jail already is. It is not interface-based
because netavark's bridge name (podman1) is not pinned.

setup_nftables also validates the rendered file before installing it.
Previously it installed first and validated second, so a ruleset that
failed to parse stayed in /etc/sysconfig and would fail nftables.service
on the next boot, leaving the host with no gitea_filter table.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

vm/bootstrap.sh

@@ -198,8 +198,21 @@ setup_nftables() {
     systemctl disable --now firewalld >/dev/null 2>&1 || true
     systemctl mask firewalld >/dev/null 2>&1 || true
 
-    install -m 0600 "${STATE_DIR}/nftables/gitea.nft" /etc/sysconfig/nftables.conf
-    nft -c -f /etc/sysconfig/nftables.conf || die "nftables ruleset failed validation"
+    [[ -n "${PODMAN_SUBNET}" && -n "${PODMAN_GATEWAY}" ]] \
+        || die "podman-subnet/podman-gateway metadata missing; cannot render the ruleset"
+
+    # Validate BEFORE installing. A ruleset that fails to parse must never land
+    # in /etc/sysconfig: nftables.service would fail to load it on the next boot
+    # and the host would come up with no gitea_filter table at all.
+    local tmp
+    tmp=$(mktemp)
+    envsubst '${PODMAN_SUBNET} ${PODMAN_GATEWAY}' < "${STATE_DIR}/nftables/gitea.nft" > "${tmp}"
+    if ! nft -c -f "${tmp}"; then
+        rm -f "${tmp}"
+        die "nftables ruleset failed validation"
+    fi
+    install -m 0600 "${tmp}" /etc/sysconfig/nftables.conf
+    rm -f "${tmp}"
     systemctl enable --now nftables
     systemctl reload nftables