Hubris is Netbird-only and LXC 105 is Tailscale-only; they share LAN but not a mesh, so on-host \`curl http://192.168.8.205:9820/issue\` arrives with source IP 192.168.8.77. In a homelab LAN with no untrusted devices the trust boundary is reasonable; if that changes later, narrow this. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>