Firewall + idempotent reload
Opened all required ports in ufw and validated with nginx -t + reload (no downtime).
Split-DNS for local reachability
Updated /etc/hosts so id/relay/github.generalinfinity.cloud resolve to the proxy IP on that box, ensuring clients hit the proxy internally.
