The agent host's vault and SilverBullet (M5.4)

deploy/agent-host sets up the vault on nisse-host (infra/tofu#77) and
SilverBullet over it: the operator writes the vault, the agents' memory/
is read-only to it, and only the operator's Caddy reaches it, which
serves vault.dongar.net to the LAN. scripts/agent-host.sh installs and
checks it from here.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk

deploy/agent-host/nisse-firewall

@@ -0,0 +1,12 @@
+#!/bin/sh
+# nisse-firewall ADDRESS PORT: only ADDRESS may reach a port Docker publishes
+# as PORT. Docker publishes ports past the host's own firewall rules, so the
+# limit goes in its DOCKER-USER chain. Installed by setup.sh and run by
+# nisse-firewall.service whenever Docker starts. Its own rules (tagged) are
+# replaced each run, so a changed address leaves no old rule behind.
+set -eu
+address=$1 port=$2
+iptables -S DOCKER-USER | grep -- '--comment nisse-firewall' | sed 's/^-A /-D /' |
+  while read -r old; do eval "iptables $old"; done
+iptables -I DOCKER-USER -p tcp -m conntrack --ctorigdstport "$port" \
+  --ctdir ORIGINAL ! -s "$address" -m comment --comment nisse-firewall -j DROP