deploy: admit named hosts at other sites to a node's RPC

A per-node rpc_extra_sources list of mesh names, each resolved on the node
into a /32 firewalld rich rule for quantus-node-rpc, beside the site-subnet
rule. bob gets oolon.kosherinata.internal: the kosherinata edge proxy that
publishes the node as wss://quantus.blackbeard.observer for the blackbeard
wallet (blackbeard/wallet #53). The rule is already applied on bob by hand
with the same command; this makes the next deploy agree with it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014ftBXYuba8ARhQeF74oUgW

.gitea/workflows/deploy.yaml

@@ -252,6 +252,13 @@ jobs:
             # forced acknowledgement. What actually keeps this safe is
             # --rpc-methods safe, which stays.
             rpc_expose: "--unsafe-rpc-external --rpc-methods safe --rpc-cors all --rpc-rate-limit 300 --rpc-rate-limit-whitelisted-ips 127.0.0.1/32"
+            # Hosts OUTSIDE the node's own site that may reach its RPC, by
+            # mesh name, space-separated; each becomes a /32 rich rule. oolon
+            # is the kosherinata edge proxy that publishes this node as
+            # wss://quantus.blackbeard.observer for the blackbeard wallet
+            # (blackbeard/wallet #53); the site-subnet rule below does not
+            # cover it because the proxy is at another site.
+            rpc_extra_sources: "oolon.kosherinata.internal"
           # Second site, for decentralisation. Uncomment when provisioned, and
           # give it its OWN inner_hash derived from its OWN wallet — sharing
           # bob's would publicly tie the two sites to one operator and defeat
@@ -535,6 +542,25 @@ jobs:
               run "sudo firewall-cmd --permanent --zone=$zone --add-rich-rule='$rrich'"
               run "sudo firewall-cmd --zone=$zone --add-rich-rule='$rrich'"
             fi
+            # 5e. RPC from named hosts at other sites (an edge proxy that
+            #     publishes this node). Resolved on the node so, again, no
+            #     10.x literal lives in this file; refused unless it is a
+            #     mesh address.
+            for src in ${{ matrix.rpc_extra_sources }}; do
+              src_ip=$(run "getent ahostsv4 $src" | awk '{print $1; exit}')
+              case "$src_ip" in
+                10.*) ;;
+                *) echo "refusing rpc_extra_source '$src' at non-mesh address '${src_ip}'" >&2; exit 1 ;;
+              esac
+              echo "rpc also allowed from: ${src} (${src_ip}/32)"
+              xrich="rule family=ipv4 source address=${src_ip}/32 service name=quantus-node-rpc accept"
+              if run "sudo firewall-cmd --zone=$zone --query-rich-rule='$xrich'"; then
+                echo "firewalld: rpc rich rule for ${src} already present in ${zone}"
+              else
+                run "sudo firewall-cmd --permanent --zone=$zone --add-rich-rule='$xrich'"
+                run "sudo firewall-cmd --zone=$zone --add-rich-rule='$xrich'"
+              fi
+            done
           else
             echo "rpc: loopback only (rpc_expose empty)"
           fi