feat: added support for running the VPN router on a host with Docker Community Edition.

ADR.md

@@ -0,0 +1,28 @@
+# Architecture Decision Records
+
+## ADR-1: Docker's published ports are filtered in DOCKER-USER by the package
+
+Status: Accepted
+
+Context: Docker adds its own iptables rules for published ports. They are evaluated before
+UFW's, so a published port is reachable from the external interface whatever UFW says. Docker
+reserves the `DOCKER-USER` chain, evaluated first in `FORWARD`, for rules of the operator. The
+router is an internet-facing host, and Docker is installed on it for services run alongside the
+router.
+
+Decision: The package secures Docker itself. A `docker` configuration section has `mode`
+(`auto`, `on`, `off`) and `exposed_ports`. In `auto` mode the rules are applied when
+`docker.service` is installed, which is what the package looks up; `on` requires Docker and
+`off` removes the rules. The rules are in a chain of their own, `VPN-ROUTER-DOCKER`, entered by
+one jump at the top of `DOCKER-USER`. For traffic from the external interface they accept IPsec
+protected traffic, TCP to `exposed_ports` and established connections, and drop the rest. The
+`vpn-router-docker` unit applies them after `docker.service` starts and removes them when it
+stops; `vpn-router-setup` restarts it while Docker runs.
+
+Consequences: Installing Docker first is recommended; `auto` mode then finds it as soon as the
+package is configured. When Docker is installed after the package, the rules are applied by
+restarting `vpn-router-setup`, a reboot or a restart of Docker, not by Docker's first start,
+because `vpn-router-docker` is already active. A published
+port is reachable from the external interface only when it is in `exposed_ports`. Other rules
+in `DOCKER-USER` are not touched, because the package owns only its own chain. Restarting Docker
+restores the rules. The rules cover IPv4 only.