refactor(ha): renumber cluster→VLAN10, storage→VLAN20; iSCSI/NFS protocol separation

Renumber internal HA bridges so VLAN ID matches IP third octet:
  vmbr1 (cluster): 192.168.4.x → 192.168.10.x (VLAN 10, /29)
  vmbr2 (storage): 192.168.5.x → 192.168.20.x (VLAN 20, /24)

Enforce protocol separation at the firewall on both HA nodes:
  - iSCSI (3260/tcp): storage-client subnet (192.168.20.0/24) only
  - NFS (111,2049,20048 tcp+udp): LAN subnet (192.168.2.0/24) only
  - Cluster subnet (192.168.10.224/29) accepted wholesale (DRBD+Corosync)
Moves from allowedTCPPorts/allowedUDPPorts to source-restricted extraCommands
rules on the nixos-fw chain.

NFS exports reduced to LAN-only (drop haClientCidr lines from mkNfsExports).
Storage-client network clients use iSCSI only; no NFS on VLAN 20.

All HA script VIP/storage IP defaults updated to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2

modules/build-types/ha-server.nix

@@ -17,14 +17,12 @@
 { lib, pkgs, vars, ... }:
 
 let
-  # Generates /etc/exports lines for all nfsShares data entries. Each share
-  # gets two export lines — one for LAN clients (pxe-boot, proxmox host) and
-  # one for storage-client-subnet clients (docker, server via vmbr2).
+  # Generates /etc/exports lines for all nfsShares data entries.
+  # NFS is LAN-only (VLAN 2). Storage-client subnet (VLAN 20) uses iSCSI only.
   mkNfsExports = storageRoot:
     lib.concatMapStrings
       (share:
-        "  ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n" +
-        "  ${storageRoot}/${share.subpath} ${vars.haClientCidr}${vars.nfsShares.options}\n")
+        "  ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n")
       (lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares));
 in
 {

modules/ha/cluster-config.nix

@@ -131,27 +131,31 @@ in
 
   networking.firewall = {
     allowedTCPPorts = [
-      vars.ports.haServerIscsi
       vars.ports.haServerPacemakerRemoted
       vars.ports.haServerPcsd
       vars.ports.haServerDrbd
-      vars.ports.nfsRpcbind
-      vars.ports.nfsd
-      vars.ports.nfsMountd
     ];
     allowedUDPPorts = [
       vars.ports.haServerCorosync1
       vars.ports.haServerCorosync2
       vars.ports.haServerCorosyncCrypto
-      vars.ports.nfsRpcbind
-      vars.ports.nfsd
-      vars.ports.nfsMountd
     ];
+    # Protocol separation: iSCSI (VLAN 20 / storage clients only),
+    # NFS (VLAN 2 / LAN only).  Cluster-internal subnets accepted wholesale
+    # since they are isolated bridges with no external uplink.
     extraCommands = ''
-      iptables -A INPUT -s ${vars.haServer1Ip}/32 -j ACCEPT
-      iptables -A INPUT -s ${vars.haServer2Ip}/32 -j ACCEPT
-      iptables -A INPUT -s ${vars.haStorageCidr} -j ACCEPT
-      iptables -A INPUT -s ${vars.haClientCidr} -j ACCEPT
+      iptables -A nixos-fw -s ${vars.haServer1Ip}/32 -j nixos-fw-accept
+      iptables -A nixos-fw -s ${vars.haServer2Ip}/32 -j nixos-fw-accept
+      iptables -A nixos-fw -s ${vars.haStorageCidr} -j nixos-fw-accept
+
+      iptables -A nixos-fw -p tcp -s ${vars.haClientCidr} --dport ${toString vars.ports.haServerIscsi} -j nixos-fw-accept
+
+      iptables -A nixos-fw -p tcp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsRpcbind} -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsRpcbind} -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsd} -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s ${vars.lanCidr} --dport ${toString vars.ports.nfsMountd} -j nixos-fw-accept
     '';
   };
 }