docs: document static host IP and DHCP pool for external access

Record the final networking setup: host static 192.168.1.2 (netplan),
HA/Samba macvlan .246/.247, DHCP pool narrowed to .11-.245 so the
statics stay protected, and why static-at-host beats DHCP reservation
on the NOS router. Hard-code 192.168.1.2 in the port-forward table.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -189,10 +189,7 @@ Visit `http://server:3000` on first start (LAN only) and complete the install wi
 | Web UI | `http://server:3000` | `https://git-padriano.duckdns.org` |
 | Git SSH | `ssh://git@server:2222` | `ssh://git@git-padriano.duckdns.org:2222` |
 
-For external access, forward these ports on your router to the server IP:
+For external access, forward these ports on your router to the server IP — see [Networking & External Access](#networking--external-access) below for the full setup.
-
-- TCP `443` → Caddy (HTTPS — serves both HA and Forgejo)
-- TCP `2222` → Forgejo SSH
 
 #### Git remote URL examples
 
@@ -209,6 +206,69 @@ git clone ssh://git@server:2222/padriano/my-repo.git
 
 ---
 
+## Networking & External Access
+
+### Address layout
+
+The stack uses fixed addresses on the `192.168.1.0/23` LAN:
+
+| Address | Belongs to | Assigned by |
+|---------|------------|-------------|
+| `192.168.1.2` | The server host itself (Docker publishes Caddy `:443`/`:80` and Forgejo `:2222` here) | Static at the OS level — netplan `/etc/netplan/99-server-static.yaml` on interface `enp0s31f6` |
+| `192.168.1.246` | `homeassistant` macvlan interface | Static (`docker-compose.yml`) |
+| `192.168.1.247` | `samba` macvlan interface | Static (`docker-compose.yml`) |
+
+Caddy and Forgejo publish their ports on the **host IP** (`192.168.1.2`, via Docker port mapping) — *not* on `192.168.1.246`. The macvlan IP belongs only to the Home Assistant container; Caddy reaches HA over the internal bridge network by container name.
+
+#### Keeping these IPs stable (router DHCP)
+
+All three static IPs must sit **outside the router's DHCP pool** so the router can never lease them to another device. On the NOS F@st 5670 the DHCP pool is set to:
+
+- **Pool start `192.168.1.11`, end `192.168.1.245`** — this leaves `.2`–`.10` and `.246`–`.254` free for static use.
+
+> **Why static-at-the-host instead of a DHCP reservation:** the NOS router only reserves a device's *current* lease, and refuses to reserve any IP already present in the DHCP leases table. Combined with the macvlan containers (which don't use DHCP at all and never appear in the leases table), reservations proved unworkable. Pinning the host IP in netplan and carving the static range out of the DHCP pool is the reliable approach.
+>
+> **History:** the host originally took `192.168.1.246` from DHCP — the *same* IP statically assigned to the Home Assistant container — causing an address collision (two MACs answering for `.246`). Moving the host to a static `.2` outside the pool resolved it.
+
+To re-apply the host static IP after a fresh OS install, recreate `/etc/netplan/99-server-static.yaml`:
+
+```yaml
+network:
+  version: 2
+  renderer: NetworkManager
+  ethernets:
+    enp0s31f6:
+      dhcp4: false
+      addresses:
+        - 192.168.1.2/23
+      routes:
+        - to: default
+          via: 192.168.1.1
+      nameservers:
+        addresses: [192.168.1.1, 1.1.1.1]
+```
+
+Then `sudo netplan apply`. Cloud-init network management is disabled via `/etc/cloud/cloud.cfg.d/99-disable-network-config.cfg` (`network: {config: disabled}`) so it doesn't override this on reboot.
+
+### Router port forwarding
+
+Forward exactly two ports to the host IP `192.168.1.2`. The single `443` rule serves **both** sites — Caddy routes by hostname.
+
+| Service | Protocol | External port | Internal host | Internal port |
+|---------|----------|---------------|---------------|---------------|
+| HTTPS (Caddy → Home Assistant **and** Forgejo) | TCP | 443 | `192.168.1.2` | 443 |
+| Forgejo SSH | TCP | 2222 | `192.168.1.2` | 2222 |
+
+Do **not** forward:
+
+- `8123` (Home Assistant) — bypasses Caddy and exposes the UI over plaintext HTTP. Use `https://ha-padriano.duckdns.org` instead.
+- `3000` (Forgejo) — not exposed on the host; access is via Caddy only.
+- `22` — not used by this stack; Forgejo SSH is on `2222`.
+
+Port `80` is optional — forward it only if you want bare `http://` requests auto-redirected to HTTPS. It is **not** required for certificates, which use the DuckDNS DNS-01 challenge.
+
+---
+
 ## Disk Space
 
 ```bash