Allow homebrew store DNS lookups

docs/HANDOFF.md

@@ -69,9 +69,11 @@ kadinho <[email protected]>
 - restart policy: `unless-stopped`.
 
 The same Compose project also runs `ps5-guide-gateway`, bound specifically to
-`192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves only
-`manuals.playstation.net`, returns NXDOMAIN for every other name, and redirects the
-User Guide to `http://192.168.20.30:8000/`.
+`192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves
+`manuals.playstation.net` locally and forwards only `homebrew.page`, `github.com`
+and `release-assets.githubusercontent.com` to the configured upstream resolver
+(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway
+redirects the User Guide to `http://192.168.20.30:8000/`.
 
 Port `8080` on the host is already used by `unifi-network-application`; do not move
 this service there. At the last verification, the Relapse container was healthy,
@@ -169,9 +171,12 @@ the local container. The local gateway was therefore added. Configure the PS5 wi
 primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the console and
 accept the self-signed certificate warning in the User Guide.
 
-The gateway intentionally provides no recursive DNS forwarding. Only
-`manuals.playstation.net` resolves; all other names receive NXDOMAIN. This blocks
-PSN and update resolution and keeps the setup independent of a public DNS operator.
+The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
+`github.com` and `release-assets.githubusercontent.com`. Only those names and
+`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
+the homebrew store catalog and HTTPS release downloads while continuing to block
+PSN and update resolution. The PS5 sends DNS only to `net-utils01`; that host must
+be allowed to reach the configured upstream resolver on UDP/TCP 53.
 The PS5 was previously identified as `192.168.10.26`; requests from
 `192.168.10.6` seen at that time were from a different client. Those addresses
 are historical and must not be used as the current payload destination.

docs/PS5_SETUP.md

@@ -137,8 +137,11 @@ O Compose inclui um DNS controlado no `net-utils01` que:
 
 - bloqueie domínios PlayStation/PSN e servidores de atualização;
 - responda `manuals.playstation.net` com `192.168.20.30`;
-- devolva `NXDOMAIN` para todos os restantes nomes, bloqueando PSN, updates,
-  telemetria e acesso geral à Internet por DNS;
+- encaminhe apenas `homebrew.page`, `github.com` e
+  `release-assets.githubusercontent.com` para o resolvedor configurado, permitindo
+  o catálogo, ícones e downloads HTTPS do homebrew store;
+- devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e
+  telemetria bloqueados por DNS;
 - registe as consultas nos logs do container;
 - apresente um gateway HTTPS local e redirecione o browser para o exploit em
   `http://192.168.20.30:8000/`.
@@ -160,6 +163,17 @@ definir `GATEWAY_BIND_IP`, `GATEWAY_IP` e `GUIDE_REDIRECT_URL` antes de executar
 Compose. Também é possível bloquear o acesso WAN da PS5 no router, mantendo apenas
 a comunicação LAN; esta continua a ser uma camada adicional mais forte do que DNS.
 
+O resolvedor upstream predefinido é `1.1.1.1`. Pode ser substituído por um endereço
+DNS controlado na rede através de `UPSTREAM_DNS`; o valor deve ser um endereço IP,
+não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para esse
+resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
+`192.168.20.30`; não deve consultar diretamente um DNS público.
+
+O acesso WAN da consola pode ficar limitado a TCP `443` para os três domínios
+permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar
+os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será
+bloqueado até esse destino ser revisto e acrescentado explicitamente.
+
 ## Abrir pelo Guia do Utilizador
 
 Com um DNS que redirecione o manual: