feat(odin): add NAT for container internet access and git in Gogs container

- Adds container-nat.nix to masquerade traffic from private containers through enp3s0
- Installs git in the Gogs container for shell-based debugging

hosts/odin/containers/gogs.nix

@@ -1,4 +1,4 @@
-{ outputs, ... }:
+{ outputs, pkgs, ... }:
 {
   imports = [
     # TODO: auto-import via `outputs.modules.nixos`
@@ -44,6 +44,7 @@
     useDHCP = false;
   };
 
+  environment.systemPackages = [ pkgs.git ];
   boot.isContainer = true;
   system.stateVersion = "26.05";
 }

hosts/odin/services/container-nat.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+let
+  containersWithNet = lib.filterAttrs (_: v: v.privateNetwork or false) config.containers;
+  containerIfaces = map (name: "ve-${name}") (lib.attrNames containersWithNet);
+in {
+  networking.nat = {
+    enable = true;
+    internalInterfaces = containerIfaces;
+    externalInterface = "enp3s0";
+  };
+}

hosts/odin/services/default.nix

@@ -3,6 +3,7 @@
     ./adguard.nix
     ./caddy.nix
     ./cloudflared.nix
+    ./container-nat.nix
     ./immich.nix
     ./ntfy.nix
     ./samba.nix