refactor: Remove GRE tunnels, add Mullvad gateway health check

Radical simplification — no more VPS data plane:
- Delete parahub-vpn-tunnel init script (GRE6 no longer used)
- Revert heartbeat to clean version (no tunnel_ip parsing)
- Add parahub-gw-check: monitors WireGuard handshake, switches
  batman-adv gw_mode between server/client (cron every 2 min)
- Update uci-defaults: remove vpn_tunnel zone/interface, start
  bumblebee as gw_mode=client (health check promotes to server)

Guest internet now requires Mullvad — kill switch by design.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/etc/init.d/parahub-vpn-tunnel

@@ -1,97 +0,0 @@
-#!/bin/sh /etc/rc.common
-# Parahub VPN Tunnel — Creates GRE6 tunnel over Yggdrasil for guest traffic
-# Runs after yggdrasil (START=95). OpenWrt 25.x lacks the netifd grev6 protocol
-# handler, so we create the tunnel manually with ip6gre.
-#
-# Tunnel IP is assigned by Django and stored in /etc/parahub/tunnel_ip.
-# If the file doesn't exist (first boot), heartbeat is called synchronously to get it.
-#
-# IMPORTANT: encaplimit must be "none" — Yggdrasil drops IPv6 packets with
-# Destination Options extension headers (added by default encaplimit 4).
-
-START=96
-STOP=10
-
-VPS_YGG="200:39f1:6a26:328a:d901:fbd2:d30d:faef"
-GRE_GATEWAY="172.16.0.1"
-TUNNEL_IP_FILE="/etc/parahub/tunnel_ip"
-
-start() {
-    # Only for Bumblebee role
-    [ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || return 0
-
-    # Wait for Yggdrasil address (up to 60s)
-    local ygg_addr="" attempts=0
-    while [ $attempts -lt 30 ]; do
-        ygg_addr=$(ip -6 addr show dev ygg0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
-        [ -n "$ygg_addr" ] && break
-        attempts=$((attempts + 1))
-        sleep 2
-    done
-
-    if [ -z "$ygg_addr" ]; then
-        logger -t parahub-vpn "No Yggdrasil address after 60s, skipping GRE6 tunnel"
-        return 1
-    fi
-
-    # Get tunnel IP — from file, or request via heartbeat on first boot
-    local gre_local_ip
-    gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)
-
-    if [ -z "$gre_local_ip" ]; then
-        logger -t parahub-vpn "No tunnel IP file, calling heartbeat to get assignment..."
-        HEARTBEAT_CURL_TIMEOUT=30 /usr/bin/parahub-heartbeat
-        gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)
-    fi
-
-    if [ -z "$gre_local_ip" ]; then
-        logger -t parahub-vpn "Failed to get tunnel IP from heartbeat, falling back to 172.16.0.2"
-        gre_local_ip="172.16.0.2"
-    fi
-
-    # Create GRE6 tunnel (encaplimit none — critical for Yggdrasil compatibility)
-    ip -6 tunnel add gre6-vpn mode ip6gre \
-        remote "$VPS_YGG" \
-        local "$ygg_addr" \
-        encaplimit none
-    ip addr add ${gre_local_ip}/24 dev gre6-vpn
-    ip link set gre6-vpn mtu 1400 up
-
-    # Default route through GRE (table 100 — used by guest policy routing)
-    ip route add default via "$GRE_GATEWAY" table 100
-
-    # Guest subnet direct route in table 100 (background — WiFi may not be up yet)
-    # Without this, router's own replies (source IP in guest subnet) go through
-    # GRE instead of back to the guest client (ip rule matches source-based)
-    local guest_subnet
-    guest_subnet=$(awk -F= '/GUEST_SUBNET/{print $2}' /etc/parahub/keys 2>/dev/null)
-    if [ -n "$guest_subnet" ]; then
-        # WiFi interfaces take time to come up at boot — retry in background
-        (
-            local guest_dev="" ga=0
-            while [ $ga -lt 30 ]; do
-                guest_dev=$(ip route | grep "^${guest_subnet} " | awk '{print $3}')
-                [ -n "$guest_dev" ] && break
-                ga=$((ga + 1))
-                sleep 2
-            done
-            if [ -n "$guest_dev" ]; then
-                ip route add "$guest_subnet" dev "$guest_dev" table 100 2>/dev/null
-                logger -t parahub-vpn "Guest route: $guest_subnet via $guest_dev in table 100"
-            else
-                logger -t parahub-vpn "Warning: guest device not found for $guest_subnet after 60s"
-            fi
-        ) &
-    fi
-
-    # Reload firewall so vpn_tunnel zone picks up gre6-vpn device
-    /etc/init.d/firewall reload 2>/dev/null &
-
-    logger -t parahub-vpn "GRE6 tunnel up: ${gre_local_ip} → ${VPS_YGG} via $ygg_addr (encaplimit none)"
-}
-
-stop() {
-    ip route flush table 100 2>/dev/null
-    ip -6 tunnel del gre6-vpn 2>/dev/null
-    logger -t parahub-vpn "GRE6 tunnel down"
-}

files/etc/uci-defaults/99-parahub-mesh

@@ -4,7 +4,7 @@
 # It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
 #
 # Roles:
-#   bumblebee (L3 Gateway) — full stack: yggdrasil, GRE6, VPN, guest isolation, SQM, DoH
+#   bumblebee (L3 Gateway) — full stack: yggdrasil, Mullvad VPN, guest isolation, speed control, DoH
 #   bee (L2 Transport)     — minimal: batman-adv mesh relay, heartbeat
 
 # Read firmware role (written by build.sh)
@@ -175,7 +175,7 @@ NET_EOF
     done
 
 else
-    # --- Bumblebee: full network (gw_mode=server, GRE6, guest, policy routing) ---
+    # --- Bumblebee: full network (gw_mode starts as client, promoted to server by gw-check when Mullvad is up) ---
     uci batch <<-NET_EOF
 # --- loopback ---
 set network.loopback=interface
@@ -184,14 +184,14 @@ set network.loopback.proto='static'
 set network.loopback.ipaddr='127.0.0.1'
 set network.loopback.netmask='255.0.0.0'
 
-# --- bat0 (batman-adv, server mode — acts as gateway for Bee nodes) ---
+# --- bat0 (batman-adv, starts as client — gw-check promotes to server when Mullvad is active) ---
 set network.bat0=interface
 set network.bat0.proto='batadv'
 set network.bat0.routing_algo='BATMAN_V'
 set network.bat0.aggregated_ogms='1'
 set network.bat0.bridge_loop_avoidance='1'
 set network.bat0.distributed_arp_table='1'
-set network.bat0.gw_mode='server'
+set network.bat0.gw_mode='client'
 set network.bat0.hop_penalty='15'
 set network.bat0.orig_interval='1000'
 
@@ -229,12 +229,7 @@ set network.wan=interface
 set network.wan.device='${WAN_DEV}'
 set network.wan.proto='dhcp'
 
-# --- VPN tunnel interface (device created by parahub-vpn-tunnel init script) ---
+# --- Policy routing: guest traffic → Mullvad table 100 ---
-set network.vpn_tunnel=interface
-set network.vpn_tunnel.device='gre6-vpn'
-set network.vpn_tunnel.proto='none'
-
-# --- Policy routing: guest traffic → VPN table 100 ---
 add network rule
 set network.@rule[-1].src='${GUEST_SUBNET}/24'
 set network.@rule[-1].lookup='100'
@@ -448,7 +443,7 @@ set firewall.@rule[-1].target='ACCEPT'
 FW_EOF
 
 else
-    # --- Bumblebee: full firewall (4 zones, guest isolation, kill switch) ---
+    # --- Bumblebee: full firewall (3 zones + mullvad_local added by parahub-mullvad, guest kill switch) ---
     uci batch <<-FW_EOF
 # --- Zone: lan (private network) ---
 add firewall zone
@@ -476,25 +471,14 @@ set firewall.@zone[-1].masq='1'
 set firewall.@zone[-1].mtu_fix='1'
 add_list firewall.@zone[-1].network='wan'
 
-# --- Zone: vpn_tunnel (GRE6 → VPS → Mullvad) ---
-add firewall zone
-set firewall.@zone[-1].name='vpn_tunnel'
-set firewall.@zone[-1].input='REJECT'
-set firewall.@zone[-1].output='ACCEPT'
-set firewall.@zone[-1].forward='REJECT'
-set firewall.@zone[-1].masq='1'
-set firewall.@zone[-1].mtu_fix='1'
-add_list firewall.@zone[-1].network='vpn_tunnel'
-
 # --- Forwarding: lan → wan (internet for owner) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='lan'
 set firewall.@forwarding[-1].dest='wan'
 
-# --- Forwarding: guest → vpn_tunnel ONLY (kill switch: no wan!) ---
+# NOTE: guest → mullvad_local forwarding is added by parahub-mullvad setup.
-add firewall forwarding
+# Without Mullvad configured, guests have NO internet (kill switch by design).
-set firewall.@forwarding[-1].src='guest'
+# parahub-gw-check monitors Mullvad and sets gw_mode accordingly.
-set firewall.@forwarding[-1].dest='vpn_tunnel'
 
 # --- Rule: guest DHCP (allow guests to get IP) ---
 add firewall rule
@@ -681,7 +665,7 @@ if [ "$ROLE" != "bee" ]; then
     # Generate unique keys for this node
     yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
 
-    # Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
+    # Add VPS as static Yggdrasil peer (management plane: remote access, heartbeat)
     sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
 
     # UCI network interface for yggdrasil TUN
@@ -717,13 +701,6 @@ set firewall.@rule[-1].proto='tcp'
 set firewall.@rule[-1].dest_port='80'
 set firewall.@rule[-1].target='ACCEPT'
 
-# Allow GRE6 protocol input (tunnel endpoint)
-add firewall rule
-set firewall.@rule[-1].name='Allow GRE6 input'
-set firewall.@rule[-1].src='yggdrasil'
-set firewall.@rule[-1].proto='47'
-set firewall.@rule[-1].target='ACCEPT'
-
 # Allow ICMPv6 on Yggdrasil
 add firewall rule
 set firewall.@rule[-1].name='Allow ICMPv6 Ygg'
@@ -748,9 +725,8 @@ set firewall.@forwarding[-1].dest='yggdrasil'
 YGG_FW_EOF
     uci commit firewall
 
-    # Enable yggdrasil service + VPN tunnel (creates GRE6 after yggdrasil starts)
+    # Enable yggdrasil service
     /etc/init.d/yggdrasil enable 2>/dev/null || true
-    /etc/init.d/parahub-vpn-tunnel enable 2>/dev/null || true
 
     # Save yggdrasil address to node keys file
     YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
@@ -796,9 +772,11 @@ fi
 
 chmod +x /usr/bin/parahub-heartbeat
 chmod +x /usr/bin/parahub-autoupdate
+chmod +x /usr/bin/parahub-gw-check
 
-# Cron: heartbeat every 5 minutes + OTA update nightly at 3am
+# Cron: heartbeat every 5 min, gateway health check every 2 min, OTA nightly
 echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
+echo "*/2 * * * * /usr/bin/parahub-gw-check" >> /etc/crontabs/root
 echo "0 3 * * * /usr/bin/parahub-autoupdate" >> /etc/crontabs/root
 /etc/init.d/cron enable
 
@@ -819,10 +797,10 @@ else
     logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
     logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
     logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
-    logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
+    logger -t parahub-mesh "Guest internet: via local Mullvad (parahub-mullvad setup required)"
-    logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
+    logger -t parahub-mesh "Kill switch: guest blocked without Mullvad (by design)"
     logger -t parahub-mesh "Guest IPv6: Yggdrasil SLAAC (full speed, firewall restricted)"
-    logger -t parahub-mesh "bat0 gw_mode: server (gateway for Bee nodes)"
+    logger -t parahub-mesh "bat0 gw_mode: client (promoted to server by gw-check when Mullvad active)"
 fi
 
 exit 0

files/usr/bin/parahub-gw-check

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Parahub Gateway Health Check
+# Monitors Mullvad WireGuard status and switches batman-adv gw_mode:
+#   - Mullvad active (recent handshake) → gw_mode=server (advertise as gateway)
+#   - Mullvad down or not configured    → gw_mode=client (relay only)
+#
+# Run via cron every 2 minutes. Bumblebee only.
+
+[ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || exit 0
+
+# Check if Mullvad WireGuard interface exists and has recent handshake
+MULLVAD_OK=0
+if command -v wg >/dev/null 2>&1; then
+    # Get latest handshake timestamp from any WireGuard interface
+    LAST_HS=$(wg show all latest-handshakes 2>/dev/null | awk '{print $NF}' | sort -rn | head -1)
+    if [ -n "$LAST_HS" ] && [ "$LAST_HS" -gt 0 ] 2>/dev/null; then
+        NOW=$(date +%s)
+        AGE=$((NOW - LAST_HS))
+        # Handshake within last 5 minutes = alive
+        [ "$AGE" -lt 300 ] && MULLVAD_OK=1
+    fi
+fi
+
+CURRENT_MODE=$(batctl gw_mode 2>/dev/null | awk '{print $1}')
+
+if [ "$MULLVAD_OK" = "1" ]; then
+    if [ "$CURRENT_MODE" != "server" ]; then
+        batctl gw_mode server
+        logger -t parahub-gw "Mullvad active, switched to gw_mode=server"
+    fi
+else
+    if [ "$CURRENT_MODE" != "client" ]; then
+        batctl gw_mode client
+        logger -t parahub-gw "Mullvad down, switched to gw_mode=client"
+    fi
+fi

files/usr/bin/parahub-heartbeat

@@ -37,12 +37,9 @@ PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":
 
 RESPONSE=""
 
-# Use longer timeout if called from vpn-tunnel init (first boot)
-CURL_TIMEOUT="${HEARTBEAT_CURL_TIMEOUT:-10}"
-
 if [ "$ROLE" = "bee" ]; then
     # Bee: no yggdrasil, use public URL only
-    RESPONSE=$(curl -s -m "$CURL_TIMEOUT" -X POST \
+    RESPONSE=$(curl -s -m 10 -X POST \
         -H "Content-Type: application/json" \
         -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
         -d "$PAYLOAD" \
@@ -50,13 +47,13 @@ if [ "$ROLE" = "bee" ]; then
 else
     # Bumblebee: try yggdrasil first, fallback to public
     if ping6 -c 1 -W 3 200:abb9:5810:37d3:8a4c:98a6:b82b:969a >/dev/null 2>&1; then
-        RESPONSE=$(curl -s -m "$CURL_TIMEOUT" -X POST \
+        RESPONSE=$(curl -s -m 10 -X POST \
             -H "Content-Type: application/json" \
             -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
             -d "$PAYLOAD" \
             "${PARAHUB_API_YGG}" 2>/dev/null)
     else
-        RESPONSE=$(curl -s -m "$CURL_TIMEOUT" -X POST \
+        RESPONSE=$(curl -s -m 10 -X POST \
             -H "Content-Type: application/json" \
             -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
             -d "$PAYLOAD" \
@@ -64,22 +61,6 @@ else
     fi
 fi
 
-# Parse tunnel_ip from response and update local config (Bumblebee only)
-if [ "$ROLE" != "bee" ] && [ -n "$RESPONSE" ]; then
-    NEW_TUNNEL_IP=$(echo "$RESPONSE" | jsonfilter -e '$.tunnel_ip' 2>/dev/null)
-    if [ -n "$NEW_TUNNEL_IP" ]; then
-        OLD_TUNNEL_IP=$(cat /etc/parahub/tunnel_ip 2>/dev/null)
-        if [ "$OLD_TUNNEL_IP" != "$NEW_TUNNEL_IP" ]; then
-            echo "$NEW_TUNNEL_IP" > /etc/parahub/tunnel_ip
-            logger -t parahub-heartbeat "Tunnel IP updated: ${OLD_TUNNEL_IP:-none} → $NEW_TUNNEL_IP"
-            # Restart vpn-tunnel if it's running (IP changed)
-            if [ -n "$OLD_TUNNEL_IP" ]; then
-                /etc/init.d/parahub-vpn-tunnel restart 2>/dev/null &
-            fi
-        fi
-    fi
-fi
-
 # Sync paid_clients to speed control (Bumblebee only)
 if [ "$ROLE" != "bee" ] && [ -x /usr/bin/parahub-speed-control ] && [ -n "$RESPONSE" ]; then
     PAID_IPS=$(echo "$RESPONSE" | jsonfilter -e '$.paid_clients[*]' 2>/dev/null)