Routers: NAT, port forwarding, policy and mapping expiry

A gateway is the one implicit machine in a declaration — a scenario says a
segment sits behind one and never names the thing that serves it. This
materialises it.

A router is a container, not a virtual machine, because it is scenery
rather than something under test (hq ADR 0033). Verified before building
that a plain unprivileged container can do all of it: ip_forward and ipv6
forwarding settable, nftables masquerade accepted, and the conntrack
timeouts mapping_ttl depends on both writable. No privileged mode.

Verified by running, on a machine behind a household gateway reached from
one on a routable address:

  home-server -> anchor                      0% loss, through masquerade
  anchor -> 192.168.1.135 (private, direct)  unreachable
  anchor -> 192.0.2.50:8080 (the GATEWAY)    HTTP 200

The last line is the published-but-behind-NAT case research 004 says only
exists in production. It is now a 32-second scenario on a workstation.

Segments sharing a gateway declaration share ONE router — that is what a
VLAN-capable router is, and two routers sharing an external address would
not work anyway.

mapping_ttl is read back after setting rather than assumed. Those sysctls
are not on every kernel, and a scenario that declared an expiring mapping
and silently got a permanent one would be exactly the fault being built
against.

Four bugs found by running it, three of them the same fault — a failure
made invisible.

The router had no route to a package repository, by design, so installing
nftables at raise time could not work. The image is now built once with
temporary connectivity and cached; every scenario after that needs no
network. That failure was hidden behind `|| true`, which is why it took a
raise to find.

The builder then failed on DNS: exec works before a container has an
address, and I had treated usable as ready. It now waits for the thing
actually needed.

The stock Alpine image ships `auto eth0 / inet dhcp` and its boot-time
networking service flushed the static address the scenario set — on eth0
only, so the outside interface came up bare while inside ones were fine.
The image build now neutralises it: a router reconfiguring itself from an
image default is the lab overriding the declaration. `ip addr add … || true`
had hidden this too, and is now `ip addr replace` with no swallow.

And routers were orphaned by destroy, holding their networks open so
destroy reported removing zero segments. They now carry the same machine
tag as everything else, so one query finds an instance's resources.

src/lifecycle/address.ts

@@ -98,3 +98,48 @@ function withPrefix(scenario: Scenario, segment: string, address: string): strin
   }
   return address;
 }
+
+/**
+ * Point each machine at the router serving its segment.
+ *
+ * The route is the machine's, not the mesh's — a default route is what a home network hands
+ * out, and a machine that could not reach beyond its own segment would be reproducing the
+ * wrong topology. What the lab still does not supply is the overlay: no peers, no hub, no
+ * names.
+ *
+ * The router's inside address is the first host address of the range, chosen rather than
+ * declared because a scenario has nothing to say about it.
+ */
+export async function applyDefaultRoutes(
+  scenario: Scenario,
+  machineNames: Map<string, string>,
+  log: (message: string) => void = () => {},
+): Promise<void> {
+  for (const [machine, spec] of Object.entries(scenario.machines)) {
+    if (spec.at === "detached") continue;
+    const name = machineNames.get(machine);
+    if (!name) continue;
+
+    // A machine behind a gateway routes through it. A machine attached directly to a public
+    // segment has nowhere to default to, and should not pretend otherwise.
+    const behind = spec.at.find((a) => scenario.segments[a.segment]?.gateway);
+    if (!behind) continue;
+
+    const index = spec.at.indexOf(behind);
+    for (const range of scenario.segments[behind.segment]?.cidr ?? []) {
+      const slash = range.lastIndexOf("/");
+      if (slash === -1) continue;
+      const base = range.slice(0, slash);
+      const via = base.includes(":")
+        ? `${base.replace(/::$/, "")}::1`
+        : (() => { const o = base.split("."); o[3] = "1"; return o.join("."); })();
+      const family = base.includes(":") ? "-6" : "-4";
+      await incus(
+        ["exec", name, "--", "sh", "-c",
+         `ip ${family} route replace default via ${via} dev $(ip -o link | awk -F': ' 'NR==${index + 2}{print $2}') 2>/dev/null || true`],
+        30_000,
+      );
+    }
+    log(`  routed ${machine} via its gateway on ${behind.segment}`);
+  }
+}