Enforce firewall=0 on vmbr2 VMs to prevent NAT breakage

When a VM has firewall=1, Proxmox inserts a fwbr bridge and iptables
POSTROUTING fires at the bridge step (OUT=fwbrNNNi0) rather than at
vmbr0. The MASQUERADE rule (-o vmbr0) never matches, so the VM loses
internet access.

Adds an idempotent task to the proxmox_host role that strips
firewall=1 from VM 105's net0 config whenever the playbook runs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/roles/pihole/defaults/main.yml

@@ -10,3 +10,4 @@ pihole_dns_hosts:
   - { ip: "10.10.1.125", host: "gitea.homelab" }
   - { ip: "10.10.1.137", host: "grafana.homelab" }
   - { ip: "10.10.1.3",   host: "adyrem.duckdns.org" }
+  - { ip: "10.10.1.3",   host: "mtg.homelab" }

ansible/roles/proxmox_host/tasks/main.yml

@@ -205,3 +205,20 @@
     enabled: true
     state: started
     daemon_reload: true
+
+# --- VM network firewall flags ---
+# vmbr2 VMs must have firewall=0 on their network interfaces.
+# When firewall=1, Proxmox creates a fwbr bridge; iptables POSTROUTING fires
+# at that bridge (OUT=fwbrNNNi0) before the packet reaches vmbr0, so the
+# MASQUERADE rule (-o vmbr0) never matches and VMs lose internet access.
+
+- name: Ensure claude-code VM (105) net0 has firewall disabled
+  ansible.builtin.shell: |
+    net0=$(qm config 105 | awk '/^net0:/ {print $2}')
+    if echo "$net0" | grep -q 'firewall=1'; then
+      qm set 105 --net0 "${net0//,firewall=1/,firewall=0}"
+      echo changed
+    fi
+  register: _vm105_fw
+  changed_when: "'changed' in _vm105_fw.stdout"
+  failed_when: false

ansible/roles/traefik/defaults/main.yml

@@ -13,6 +13,12 @@ traefik_services:
     public_host: "adyrem.duckdns.org"
     public_path: "/git"
     strip_prefix: "/git"
+  - name: mtg
+    host: "mtg.homelab"
+    backend: "http://10.10.2.10:3000"
+    public_host: "adyrem.duckdns.org"
+    public_path: "/mtg"
+    strip_prefix: "/mtg"
   - name: grafana
     host: "grafana.homelab"
     backend: "http://10.10.1.137:3000"