Commons computer edge is moving to a Caddy LXC on pve (192.168.1.11); the public 80/443 forwards follow shortly. The box firewall currently only opens 22/80/443 on the wired interface, so the edge cannot reach the 5555/5556/6555/3030 service ports. Allow them from the LAN only; tailnet traffic already bypasses the firewall. Follow-up PR: strip the public Caddy vhosts after the UDM flip.