host_firewall: pass LAPI client flows from wt0 to the pod port with their own address

host_firewall/defaults/main.yml

@@ -34,6 +34,11 @@ firewall:
     ifaces: {}
     v4: {}
     v6: {}
+    # Hosts outside the ring that reach a NodePort service (CrowdSec LAPI) over wt0, and the port of its pods: Cilium
+    # translates the NodePort before netfilter, so the flows arrive as client -> pod:port.
+    lapi:
+      port: null
+      clients: {}
   # IPv4 port forwards: name -> {daddr, to, tcp: ports, udp: ports}, ports as in
   # the maps above. Forwarded traffic passes the forward hook, not input.
   dnat: {}