fix(toolbox): unbound listener for br-lxc + auto-resolve from any LXC (ref #498)

Phase 7.E.3 follow-up — every LXC on br-lxc (10.100.0.0/24) had
DNS=10.100.0.1 from its static config but the host Unbound only
listened on 10.99.x (the WG subnets shipped in Phase 7.E.1 by
99-secubox-wg.conf). External DNS from inside any LXC failed
silently.

Symptom found 2026-06-08 : the Gitea pull-mirror that lives in the
gitea LXC was failing to sync from upstream
github.com/CyberMind-FR/secubox-deb with :

  Stderr: fatal: unable to access
    'https://github.com/CyberMind-FR/secubox-deb.git/':
    Could not resolve host: github.com

Failure dated back to 2026-05-17 (the day before the last successful
sync). No retry alert because the mirror is "schedule, log, move on"
and Gitea doesn't promote DNS errors to dashboard warnings. The
Gitea mirror operator only noticed because someone checked the repo
was 3 weeks behind master.

Fix : new unbound drop-in 98-secubox-lxc.conf listens on 10.100.0.1
with access-control 10.100.0.0/24 allow. Postinst now installs both
drop-ins (wg + lxc) in one pass.

Live verified : `getent hosts github.com` from inside gitea LXC
returns 140.82.121.4 ; the next mirror tick (10 min for
secubox/secubox-deb, 8 h for gandalf/secubox-deb) catches up the
~50 missing commits automatically.

packages/secubox-toolbox/debian/changelog

@@ -1,3 +1,21 @@
+secubox-toolbox (2.3.3-1~bookworm1) bookworm; urgency=medium
+
+  * Phase 7.E.3 (#498) — new unbound drop-in
+    `98-secubox-lxc.conf` makes Unbound listen on 10.100.0.1 (br-lxc
+    gateway) with access-control allowing 10.100.0.0/24. Without it
+    every LXC on br-lxc has DNS=10.100.0.1 from its static config but
+    Unbound was only listening on 10.99.x (the WG subnets shipped in
+    Phase 7.E by 99-secubox-wg.conf). All external DNS queries from
+    inside any LXC failed silently for 3 weeks — symptom found when
+    checking why the Gitea mirror sync towards github.com hadn't run
+    since 2026-05-17 : "fatal: unable to access ...: Could not
+    resolve host: github.com". The Phase 6.J + 7.E pulls had no
+    reason to detect this earlier — no LXC needed external DNS
+    until the mirror sync started failing.
+    Postinst now installs both drop-ins atomically.
+
+ -- Gérald Kerma <devel@cybermind.fr>  lun., 08 juin 2026 10:08:49 +0000
+
 secubox-toolbox (2.3.2-1~bookworm1) bookworm; urgency=medium
 
   * Phase 7 follow-up (#498) — wg LXC : privileged mode + listen-host

packages/secubox-toolbox/debian/postinst

@@ -123,13 +123,21 @@ fi
       fi
     fi
 
-    # Phase 7 (#498) : install unbound listener for wg-toolbox + captive AP.
-    # Without it WG peers' DNS queries to 10.99.1.1 (or legacy 10.99.0.1)
-    # get ICMP port unreachable and the iPhone stops resolving names.
-    if [ -f /usr/share/secubox/toolbox/unbound/99-secubox-wg.conf ] \
-        && [ -d /etc/unbound/unbound.conf.d ]; then
-      install -m 0644 /usr/share/secubox/toolbox/unbound/99-secubox-wg.conf \
-        /etc/unbound/unbound.conf.d/99-secubox-wg.conf
+    # Phase 7 (#498) : install unbound listeners.
+    # 99-secubox-wg.conf — WG peers (10.99.x). Without it WG peers' DNS
+    #   queries get ICMP port unreachable and the iPhone stops resolving.
+    # 98-secubox-lxc.conf — br-lxc (10.100.0.x). Without it every LXC
+    #   that uses DNS=10.100.0.1 (default route) gets nothing back, and
+    #   things like Gitea mirror sync towards GitHub fail with
+    #   "Could not resolve host" (3-week silent regression found
+    #   2026-06-08).
+    if [ -d /etc/unbound/unbound.conf.d ]; then
+      for f in 99-secubox-wg.conf 98-secubox-lxc.conf; do
+        if [ -f "/usr/share/secubox/toolbox/unbound/$f" ]; then
+          install -m 0644 "/usr/share/secubox/toolbox/unbound/$f" \
+            "/etc/unbound/unbound.conf.d/$f"
+        fi
+      done
       if systemctl is-active --quiet unbound.service 2>/dev/null; then
         systemctl restart unbound.service 2>/dev/null || true
       fi

packages/secubox-toolbox/debian/rules

@@ -64,6 +64,10 @@ override_dh_strip:
 	install -d debian/secubox-toolbox/usr/share/secubox/toolbox/unbound
 	install -m 0644 unbound/99-secubox-wg.conf \
 	  debian/secubox-toolbox/usr/share/secubox/toolbox/unbound/
+	# Phase 7.E.3 (#498) : also serve br-lxc (10.100.0.0/24) so every LXC
+	# can resolve external names through unbound.
+	install -m 0644 unbound/98-secubox-lxc.conf \
+	  debian/secubox-toolbox/usr/share/secubox/toolbox/unbound/
 	# Phase 7 (#498) : nginx route + rate-limit
 	install -d debian/secubox-toolbox/etc/nginx/secubox-routes.d
 	install -m 0644 nginx/toolbox.conf \

packages/secubox-toolbox/unbound/98-secubox-lxc.conf

@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: LicenseRef-CMSD-1.0
+# Phase 7.E.3 (#498) — serve DNS to the br-lxc bridge (10.100.0.0/24).
+#
+# Without this, every LXC on br-lxc has DNS=10.100.0.1 from its static
+# config but Unbound only listens on 10.99.x — so getent / curl / dig
+# from inside any LXC fails to resolve external names. Symptom found
+# 2026-06-08 : Gitea LXC mirror sync towards github.com had been
+# failing silently for 3 weeks with "Could not resolve host:
+# github.com".
+
+server:
+    interface: 10.100.0.1
+    ip-transparent: yes
+    access-control: 10.100.0.0/24 allow