docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable

host/firewalld/README.md

@@ -0,0 +1,18 @@
+# firewalld (zone `public`, interface `eno1`)
+
+## Open ports (current)
+
+| Port | Purpose |
+|------|---------|
+| 80/tcp | systemd → Caddy HTTP 9000 |
+| 9000/tcp | Caddy HTTP (VeciGate WAN:80) |
+| 9001/tcp | Caddy HTTPS (VeciGate WAN:443) |
+| 8080/tcp | Tor OR |
+| 23235/tcp | (legacy list; SSH is service `ssh` on 22) |
+| services | `ssh`, `dhcpv6-client` |
+
+## Removed
+
+- 443/tcp, 8082/tcp — obsolete after 9000-series DNAT
+
+Live dump: `list-all.txt`.

host/firewalld/list-all.txt

@@ -0,0 +1,19 @@
+public (default, active)
+  target: default
+  ingress-priority: 0
+  egress-priority: 0
+  icmp-block-inversion: no
+  interfaces: eno1
+  sources: 
+  services: dhcpv6-client ssh
+  ports: 80/tcp 443/tcp 8080/tcp 9000/tcp 9001/tcp 23235/tcp 9200/tcp
+  protocols: 
+  forward: yes
+  masquerade: no
+  forward-ports: 
+  source-ports: 
+  icmp-blocks: 
+  rich rules: 
+
+# Snapshot note (2026-07-10): 9200/tcp = Forgejo git-SSH (verified open).
+# Re-export as root: firewall-cmd --list-all > host/firewalld/list-all.txt