Resolve OQ-1/2/3, refine OQ-4: single ExpressVPN gateway, single WAN, external media

Operator answers folded into the specs:
- OQ-3 VPN: ExpressVPN, cluster-controlled SINGLE shared in-cluster tunnel
  (OpenVPN UDP / non-TCP), rules enforced outside the service. New ADR-0012
  supersedes ADR-0008 (Gluetun-sidecar default dropped). Central kill-switch.
- OQ-1 WAN/edge: one commercial WAN, no multi-ISP plans; dumb SOHO edge (no
  VLAN/VPN/services). Multi-WAN out of scope; segmentation + VPN in-cluster;
  edge = NAT + manual port-forward. Gateway VIP resolved to Cilium L2
  announcement. T-3.3 marked won't-do.
- OQ-2 storage: bulk media lives outside the cluster (backing TBD, non-blocking)
  via a 'bulk' external-mount indirection; Plex metadata DB stays on Longhorn.
  Split out a separate OQ-BKP for the off-cluster DR backup target (Phase 4).
- OQ-4 refined: wildcard record covers reachability but NOT ACME DNS-01 (needs
  TXT-write access) and does not match *.home.* depth. Still OPEN: Cloudflare
  API token (Option A) vs acme-dns delegation (Option B). T-2.4/T-2.5 blocked.

Updated: docs 00,01,03,04,08,09; ADR-0008/0012 + index; task board.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/09-dns-and-ingress.md

@@ -44,13 +44,27 @@ Internal and external answers differ:
   - `public` — additionally reachable from the internet via the edge router forwarding 80/443 to the
     Gateway.
 
-## Edge integration
+## Edge integration (single SOHO router — OQ-1 resolved)
 
-- The edge router/firewall forwards inbound 80/443 for `public` services to the Gateway's address
-  and applies multi-WAN inbound rules as needed (OQ-1).
+- The environment has **one SOHO edge router**: no VLANs, no VPN, no services, no API/IaC. Its only
+  ingress job is **manual port-forwarding of 80/443 (and specific service ports, e.g. Plex 32400,
+  Minecraft 25565) to the Gateway VIP** for `public` services. This is a documented manual edge step
+  (the SOHO device has no automation) — the analogue of the old pfSense manual-config exception.
+  Confirm the router can port-forward (basic NAT; almost all can).
+- No multi-WAN inbound rules — single WAN ([03](03-networking-isolation-and-egress.md)).
 - `internal` services are never port-forwarded; they rely on internal DNS + Gateway on the LAN.
-- A stable ingress VIP for the Gateway is provided by the cluster's LB strategy (Cilium
-  L2 announcement / BGP / a chosen LB); pin the mechanism in the networking bring-up.
+- **Ingress VIP mechanism — resolved: Cilium L2 announcement (ARP/NDP)** on the flat LAN. BGP is not
+  available on a SOHO router, and a single flat subnet makes L2 announcement the natural choice.
+
+## DNS record depth (note for `*.home.keithjackson.dev`)
+
+A wildcard `*.keithjackson.dev` matches only **one** label deep — it covers `home.keithjackson.dev`
+but **not** `plex.home.keithjackson.dev`. Consequences:
+- **`internal` services need no public record** — PiHole resolves `<svc>.home.keithjackson.dev` to
+  the internal Gateway VIP (split-horizon). This is the majority of services.
+- **`public` services** need a public record for `<svc>.home.keithjackson.dev`. That is provided by
+  either a one-time `*.home.keithjackson.dev` → public-IP record, or by **ExternalDNS via the DNS
+  API** — both hinge on OQ-4 (see [08](08-tls-and-certificates.md)).
 
 ## Interaction with default-deny
 
@@ -65,7 +79,11 @@ not let other in-cluster services reach it unless an explicit allow rule exists.
 - Internal clients resolve to the internal Gateway (no public hairpin) and get a trusted cert.
 - The root `home.keithjackson.dev` serves the C2 UI.
 
+## Resolved
+- **OQ-1** — single SOHO edge (manual port-forward only); ingress VIP via **Cilium L2 announcement**.
+
 ## Open questions
-- **OQ-1/OQ-4** — edge router product + DNS provider API (affects ExternalDNS provider config and
-  inbound WAN rules).
-- Gateway LB/VIP mechanism (Cilium L2 vs BGP) — pin during networking bring-up.
+- **OQ-4** — DNS challenge/record access: Cloudflare **API token** (automated ExternalDNS + DNS-01)
+  vs **acme-dns delegation** (one-time CNAME, no standing credential). Determines whether public
+  `*.home.keithjackson.dev` records and ACME challenges are automated or partly manual. See
+  [08](08-tls-and-certificates.md).