host_firewall: pass journal uploader flows from wt0 to the Traefik pod port with their own address

host_firewall/defaults/main.yml

@@ -39,6 +39,11 @@ firewall:
     lapi:
       port: null
       clients: {}
+    # Hosts outside the ring that upload their journal through Traefik over wt0, and the Traefik container port; as
+    # with lapi, the flows arrive as client -> pod:port.
+    journal:
+      port: null
+      clients: {}
   # IPv4 port forwards: name -> {daddr, to, tcp: ports, udp: ports}, ports as in
   # the maps above. Forwarded traffic passes the forward hook, not input.
   dnat: {}