Both containers now run in network_mode: host so the API can connect
directly to Proton Bridge on 127.0.0.1:1025. The pfSense search domain
(home.arpa) was leaking into Docker DNS and causing NXDOMAIN failures
for inter-container hostnames. Host networking bypasses this entirely.
- docker-compose: both services use network_mode: host
- nginx: listen on 8080 (was 80), proxy /api/ to 127.0.0.1:3001
- server.js: allow self-signed TLS cert from Proton Bridge
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>