feat: Add TP-Link CPE710 support, fix kmod-sched-htb and AX6S target

- Add CPE710 v1 (ath79/generic, Bee role) for 5GHz outdoor PtP links
- Replace kmod-sched-htb with kmod-sched (HTB built into kernel 6.12)
- Fix AX6S target: mediatek/filogic → mediatek/mt7622

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/etc/dropbear/authorized_keys

@@ -1 +1,2 @@
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcethx5tVJWXTj4GjG7h75Fr3IKrwdkpBRc8sN6uRrA andrey.perliev@gmail.com
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBjS7Ii3+TQcZcUkzw4kHMqZ0omyBHPl6uD9y4c4ZWBM norn@parahub-ng

files/etc/uci-defaults/99-parahub-mesh

@@ -2,9 +2,16 @@
 # Parahub Mesh Node — Zero-Touch First Boot Configuration
 # This script runs once on first boot via uci-defaults mechanism.
 # It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
+#
+# Roles:
+#   bumblebee (L3 Gateway) — full stack: yggdrasil, GRE6, VPN, guest isolation, SQM, DoH
+#   bee (L2 Transport)     — minimal: batman-adv mesh relay, heartbeat
 
 set -e
 
+# Read firmware role (written by build.sh)
+ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "bumblebee")
+
 # ============================================================================
 # 1. IDENTITY GENERATION
 # ============================================================================
@@ -55,6 +62,7 @@ mkdir -p /etc/parahub
 cat > /etc/parahub/keys <<KEYS_EOF
 # Parahub Mesh Node Keys — Generated at first boot
 # Node: ${HOSTNAME}
+# Role: ${ROLE}
 # Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)
 PRIVATE_WIFI_KEY=${PRIVATE_KEY}
 MESH_SAE_KEY=${MESH_KEY}
@@ -69,7 +77,8 @@ chmod 600 /etc/parahub/keys
 # 4. NETWORK CONFIGURATION
 # ============================================================================
 
-# Clean existing network config (preserve wan)
+if [ "$ROLE" = "bee" ]; then
+    # --- Bee: minimal network (bat0 gw_mode=client, no GRE6, no guest, no policy routing) ---
     uci batch <<-NET_EOF
 # --- loopback ---
 set network.loopback=interface
@@ -78,14 +87,65 @@ set network.loopback.proto='static'
 set network.loopback.ipaddr='127.0.0.1'
 set network.loopback.netmask='255.0.0.0'
 
-# --- bat0 (batman-adv virtual interface) ---
+# --- bat0 (batman-adv, client mode — uses Bumblebee as gateway) ---
 set network.bat0=interface
 set network.bat0.proto='batadv'
 set network.bat0.routing_algo='BATMAN_V'
 set network.bat0.aggregated_ogms='1'
 set network.bat0.bridge_loop_avoidance='1'
 set network.bat0.distributed_arp_table='1'
-set network.bat0.gw_mode='off'
+set network.bat0.gw_mode='client'
+set network.bat0.hop_penalty='15'
+set network.bat0.orig_interval='1000'
+
+# --- bat0 hardif for mesh0 (2.4GHz mesh) ---
+set network.bat0_hardif_mesh0=interface
+set network.bat0_hardif_mesh0.proto='batadv_hardif'
+set network.bat0_hardif_mesh0.master='bat0'
+
+# --- bat0 hardif for mesh1 (5GHz mesh) ---
+set network.bat0_hardif_mesh1=interface
+set network.bat0_hardif_mesh1.proto='batadv_hardif'
+set network.bat0_hardif_mesh1.master='bat0'
+
+# --- private bridge (bat0 + LAN ethernet) ---
+set network.private_dev=device
+set network.private_dev.type='bridge'
+set network.private_dev.name='br-private'
+delete network.private_dev.ports
+add_list network.private_dev.ports='bat0'
+add_list network.private_dev.ports='eth0'
+
+set network.private=interface
+set network.private.device='br-private'
+set network.private.proto='static'
+set network.private.ipaddr='${PRIV_IP}'
+set network.private.netmask='255.255.255.0'
+
+# --- wan (DHCP, create if missing) ---
+set network.wan=interface
+set network.wan.device='eth1'
+set network.wan.proto='dhcp'
+NET_EOF
+
+else
+    # --- Bumblebee: full network (gw_mode=server, GRE6, guest, policy routing) ---
+    uci batch <<-NET_EOF
+# --- loopback ---
+set network.loopback=interface
+set network.loopback.device='lo'
+set network.loopback.proto='static'
+set network.loopback.ipaddr='127.0.0.1'
+set network.loopback.netmask='255.0.0.0'
+
+# --- bat0 (batman-adv, server mode — acts as gateway for Bee nodes) ---
+set network.bat0=interface
+set network.bat0.proto='batadv'
+set network.bat0.routing_algo='BATMAN_V'
+set network.bat0.aggregated_ogms='1'
+set network.bat0.bridge_loop_avoidance='1'
+set network.bat0.distributed_arp_table='1'
+set network.bat0.gw_mode='server'
 set network.bat0.hop_penalty='15'
 set network.bat0.orig_interval='1000'
 
@@ -132,7 +192,16 @@ set network.vpn_tunnel.ipaddr='172.16.0.2'
 set network.vpn_tunnel.netmask='255.255.255.0'
 set network.vpn_tunnel.gateway='172.16.0.1'
 set network.vpn_tunnel.mtu='1400'
+set network.vpn_tunnel.ip4table='100'
+
+# --- Policy routing: guest traffic → VPN table 100 ---
+add network rule
+set network.@rule[-1].src='${GUEST_SUBNET}/24'
+set network.@rule[-1].lookup='100'
+set network.@rule[-1].priority='100'
 NET_EOF
+fi
+
 uci commit network
 
 # ============================================================================
@@ -195,8 +264,19 @@ set wireless.mesh_2g.key='${MESH_KEY}'
 set wireless.mesh_2g.network='bat0_hardif_mesh0'
 WIFI_2G_MESH
 
-    # Public AP on 2.4GHz (better range) — OWE transition mode
-    # Devices that support OWE get encrypted; legacy devices fall back to open
+    if [ "$ROLE" = "bee" ]; then
+        # Bee: Parahub_Free on private bridge (no guest isolation)
+        uci batch <<-WIFI_2G_PUB
+set wireless.public_2g=wifi-iface
+set wireless.public_2g.device='${RADIO_2G}'
+set wireless.public_2g.mode='ap'
+set wireless.public_2g.ssid='${PUBLIC_SSID}'
+set wireless.public_2g.encryption='owe'
+set wireless.public_2g.owe_transition='1'
+set wireless.public_2g.network='private'
+WIFI_2G_PUB
+    else
+        # Bumblebee: Parahub_Free on guest network (isolated)
         uci batch <<-WIFI_2G_PUB
 set wireless.public_2g=wifi-iface
 set wireless.public_2g.device='${RADIO_2G}'
@@ -208,6 +288,7 @@ set wireless.public_2g.isolate='1'
 set wireless.public_2g.network='guest'
 WIFI_2G_PUB
     fi
+fi
 
 # --- 5GHz radio: mesh backhaul + Private AP ---
 if [ -n "$RADIO_5G" ]; then
@@ -247,6 +328,51 @@ while uci -q delete firewall.@forwarding[0]; do :; done
 while uci -q delete firewall.@rule[0]; do :; done
 while uci -q delete firewall.@redirect[0]; do :; done
 
+if [ "$ROLE" = "bee" ]; then
+    # --- Bee: minimal firewall (lan + wan only) ---
+    uci batch <<-FW_EOF
+# --- Zone: lan (private network) ---
+add firewall zone
+set firewall.@zone[-1].name='lan'
+set firewall.@zone[-1].input='ACCEPT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='ACCEPT'
+add_list firewall.@zone[-1].network='private'
+
+# --- Zone: wan ---
+add firewall zone
+set firewall.@zone[-1].name='wan'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='wan'
+
+# --- Forwarding: lan → wan ---
+add firewall forwarding
+set firewall.@forwarding[-1].src='lan'
+set firewall.@forwarding[-1].dest='wan'
+
+# --- Standard WAN input rules ---
+add firewall rule
+set firewall.@rule[-1].name='Allow-DHCP-Renew'
+set firewall.@rule[-1].src='wan'
+set firewall.@rule[-1].proto='udp'
+set firewall.@rule[-1].dest_port='68'
+set firewall.@rule[-1].target='ACCEPT'
+set firewall.@rule[-1].family='ipv4'
+
+add firewall rule
+set firewall.@rule[-1].name='Allow-Ping'
+set firewall.@rule[-1].src='wan'
+set firewall.@rule[-1].proto='icmp'
+set firewall.@rule[-1].icmp_type='echo-request'
+set firewall.@rule[-1].target='ACCEPT'
+FW_EOF
+
+else
+    # --- Bumblebee: full firewall (4 zones, guest isolation, kill switch) ---
     uci batch <<-FW_EOF
 # --- Zone: lan (private network) ---
 add firewall zone
@@ -356,6 +482,8 @@ set firewall.@rule[-1].proto='icmp'
 set firewall.@rule[-1].icmp_type='echo-request'
 set firewall.@rule[-1].target='ACCEPT'
 FW_EOF
+fi
+
 uci commit firewall
 
 # ============================================================================
@@ -366,6 +494,17 @@ uci commit firewall
 uci -q delete dhcp.lan 2>/dev/null || true
 uci -q delete dhcp.guest 2>/dev/null || true
 
+if [ "$ROLE" = "bee" ]; then
+    # Bee: private DHCP only (no guest pool)
+    uci batch <<-DHCP_EOF
+set dhcp.private=dhcp
+set dhcp.private.interface='private'
+set dhcp.private.start='100'
+set dhcp.private.limit='150'
+set dhcp.private.leasetime='12h'
+DHCP_EOF
+else
+    # Bumblebee: private + guest DHCP
     uci batch <<-DHCP_EOF
 # --- Private DHCP ---
 set dhcp.private=dhcp
@@ -381,34 +520,38 @@ set dhcp.guest.start='100'
 set dhcp.guest.limit='50'
 set dhcp.guest.leasetime='1h'
 DHCP_EOF
+fi
+
 uci commit dhcp
 
 # ============================================================================
-# 8. SQM TRAFFIC SHAPING (guest 512 kbps limit)
+# 8. SPEED CONTROL (Bumblebee only — per-client shaping, paid Lightning upgrade)
 # ============================================================================
 
-# Find the guest interface device name (will be set after network restart)
-# SQM watches the interface name from the network config
+if [ "$ROLE" != "bee" ]; then
+    chmod +x /usr/bin/parahub-speed-control
 
-uci batch <<-SQM_EOF
-set sqm.guest=queue
-set sqm.guest.enabled='1'
-set sqm.guest.interface='br-guest'
-set sqm.guest.download='512'
-set sqm.guest.upload='512'
-set sqm.guest.qdisc='cake'
-set sqm.guest.script='piece_of_cake.qos'
-set sqm.guest.linklayer='ethernet'
-set sqm.guest.overhead='44'
-SQM_EOF
-uci commit sqm
+    # Create init.d service for speed control
+    cat > /etc/init.d/parahub-speed <<'INITEOF'
+#!/bin/sh /etc/rc.common
+START=99
+start() { /usr/bin/parahub-speed-control init; }
+stop() {
+    tc qdisc del dev br-guest root 2>/dev/null
+    tc qdisc del dev br-guest ingress 2>/dev/null
+    ip link del ifb-guest 2>/dev/null
+    nft delete table inet parahub 2>/dev/null
+}
+INITEOF
+    chmod +x /etc/init.d/parahub-speed
+    /etc/init.d/parahub-speed enable
+fi
 
 # ============================================================================
-# 9. DNS-OVER-HTTPS (guest DNS privacy)
+# 9. DNS-OVER-HTTPS (Bumblebee only — guest DNS privacy)
 # ============================================================================
 
-# https-dns-proxy: local DoH resolver for guest DNS queries
-# Guest DNS is hijacked via firewall redirect to this resolver
+if [ "$ROLE" != "bee" ]; then
     uci batch <<-DOH_EOF
 set https-dns-proxy.main=main
 set https-dns-proxy.main.doh_paramters='-4'
@@ -430,6 +573,7 @@ uci commit dhcp
 
     # Enable https-dns-proxy service
     /etc/init.d/https-dns-proxy enable 2>/dev/null || true
+fi
 
 # ============================================================================
 # 10. SYSTEM SETTINGS
@@ -446,9 +590,10 @@ SYS_EOF
 uci commit system
 
 # ============================================================================
-# 11. YGGDRASIL OVERLAY NETWORK
+# 11. YGGDRASIL OVERLAY NETWORK (Bumblebee only)
 # ============================================================================
 
+if [ "$ROLE" != "bee" ]; then
     # Generate unique keys for this node
     yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
 
@@ -473,19 +618,40 @@ uci commit firewall
     # Save yggdrasil address to node keys file
     YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
     echo "YGGDRASIL_ADDRESS=${YGG_ADDR}" >> /etc/parahub/keys
+else
+    YGG_ADDR="none"
+fi
 
 # ============================================================================
-# 12. FINAL
+# 12. HEARTBEAT (phone-home to Parahub cloud)
+# ============================================================================
+
+chmod +x /usr/bin/parahub-heartbeat
+
+# Cron: every 5 minutes
+echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
+/etc/init.d/cron enable
+
+# ============================================================================
+# 13. FINAL
 # ============================================================================
 
 # Log completion
-logger -t parahub-mesh "First boot configuration complete"
+logger -t parahub-mesh "First boot configuration complete (role: ${ROLE})"
 logger -t parahub-mesh "Hostname: ${HOSTNAME}"
+logger -t parahub-mesh "Role: ${ROLE}"
 logger -t parahub-mesh "Private: ${PRIVATE_SSID} @ ${PRIV_IP}/24"
+
+if [ "$ROLE" = "bee" ]; then
+    logger -t parahub-mesh "Parahub_Free: bridged to private (no guest isolation)"
+    logger -t parahub-mesh "bat0 gw_mode: client (uses Bumblebee as gateway)"
+else
     logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
     logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
     logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
     logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
     logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
+    logger -t parahub-mesh "bat0 gw_mode: server (gateway for Bee nodes)"
+fi
 
 exit 0

files/usr/bin/parahub-heartbeat

@@ -0,0 +1,71 @@
+#!/bin/sh
+# Phone-home heartbeat to Parahub cloud
+PARAHUB_API_YGG="http://[200:abb9:5810:37d3:8a4c:98a6:b82b:969a]/api/v1/iot/mesh/heartbeat"
+PARAHUB_API_PUBLIC="https://parahub.io/api/v1/iot/mesh/heartbeat"
+HEARTBEAT_KEY="IqPosrcpTQKSbLHxOG3iLTl_K2MsDxvd"
+
+# Read firmware role
+ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "unknown")
+
+# Read identity from /etc/parahub/keys
+. /etc/parahub/keys 2>/dev/null
+MAC="${NODE_MAC:-$(cat /sys/class/net/br-lan/address 2>/dev/null)}"
+HOSTNAME="$(uci -q get system.@system[0].hostname)"
+YGG_ADDR="${YGGDRASIL_ADDRESS:-unknown}"
+SSID="${PRIVATE_SSID:-unknown}"
+UPTIME="$(cut -d. -f1 /proc/uptime)"
+
+# Get mesh IP (br-private address)
+MESH_IP=$(ip -4 addr show br-private 2>/dev/null | grep -o 'inet [0-9.]*' | cut -d' ' -f2)
+MESH_IP="${MESH_IP:-unknown}"
+
+# Detect hardware from board_name
+HW=$(cat /tmp/sysinfo/board_name 2>/dev/null)
+case "$HW" in
+    glinet,gl-axt1800) HW="axt1800" ;;
+    glinet,gl-mt3000) HW="mt3000" ;;
+    glinet,gl-mt6000) HW="mt6000" ;;
+    xiaomi,redmi-router-ax6s) HW="ax6s" ;;
+    asus,rt-ax53u) HW="ax53u" ;;
+    glinet,gl-ar300m16) HW="ar300m16" ;;
+    cudy,wr3000-v1) HW="wr3000" ;;
+    *) HW="${HW:-unknown}" ;;
+esac
+
+PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"25.12.0-rc4\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\"}"
+
+RESPONSE=""
+
+if [ "$ROLE" = "bee" ]; then
+    # Bee: no yggdrasil, use public URL only
+    RESPONSE=$(curl -s -m 10 -X POST \
+        -H "Content-Type: application/json" \
+        -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
+        -d "$PAYLOAD" \
+        "${PARAHUB_API_PUBLIC}" 2>/dev/null)
+else
+    # Bumblebee: try yggdrasil first, fallback to public
+    if ping6 -c 1 -W 3 200:abb9:5810:37d3:8a4c:98a6:b82b:969a >/dev/null 2>&1; then
+        RESPONSE=$(curl -s -m 10 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
+            -d "$PAYLOAD" \
+            "${PARAHUB_API_YGG}" 2>/dev/null)
+    else
+        RESPONSE=$(curl -s -m 10 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
+            -d "$PAYLOAD" \
+            "${PARAHUB_API_PUBLIC}" 2>/dev/null)
+    fi
+fi
+
+# Sync paid_clients to speed control (Bumblebee only)
+if [ "$ROLE" != "bee" ] && [ -x /usr/bin/parahub-speed-control ] && [ -n "$RESPONSE" ]; then
+    PAID_IPS=$(echo "$RESPONSE" | jsonfilter -e '$.paid_clients[*]' 2>/dev/null)
+    # Flush and re-add all paid IPs
+    parahub-speed-control flush
+    for IP in $PAID_IPS; do
+        parahub-speed-control add "$IP"
+    done
+fi

files/usr/bin/parahub-mullvad

@@ -0,0 +1,297 @@
+#!/bin/sh
+# Parahub Mesh — Local Mullvad WireGuard Manager
+#
+# Allows the node owner to run Mullvad directly on the router.
+# Guest traffic routes through the local WireGuard tunnel instead of
+# the default GRE6→VPS path, giving lower latency and using the
+# nearest Mullvad server.
+#
+# Usage:
+#   parahub-mullvad setup <account_key> [country_code]
+#   parahub-mullvad status
+#   parahub-mullvad remove
+
+set -e
+
+PARAHUB_DIR="/etc/parahub"
+ACCOUNT_FILE="$PARAHUB_DIR/mullvad_account"
+
+# ============================================================================
+# Helpers
+# ============================================================================
+
+# Find the firewall forwarding index where src=guest
+find_guest_forwarding() {
+    local idx=0
+    while uci -q get "firewall.@forwarding[$idx]" >/dev/null 2>&1; do
+        local src=$(uci -q get "firewall.@forwarding[$idx].src")
+        if [ "$src" = "guest" ]; then
+            echo "$idx"
+            return 0
+        fi
+        idx=$((idx + 1))
+    done
+    return 1
+}
+
+# Find firewall zone index by name
+find_zone_index() {
+    local name="$1"
+    local idx=0
+    while uci -q get "firewall.@zone[$idx]" >/dev/null 2>&1; do
+        local zname=$(uci -q get "firewall.@zone[$idx].name")
+        if [ "$zname" = "$name" ]; then
+            echo "$idx"
+            return 0
+        fi
+        idx=$((idx + 1))
+    done
+    return 1
+}
+
+# ============================================================================
+# setup <account_key> [country_code]
+# ============================================================================
+
+cmd_setup() {
+    local ACCOUNT="$1"
+    local COUNTRY="$2"
+
+    if [ -z "$ACCOUNT" ]; then
+        echo "Usage: parahub-mullvad setup <account_key> [country_code]"
+        echo ""
+        echo "Examples:"
+        echo "  parahub-mullvad setup 1234567890123456 pt   # Portugal"
+        echo "  parahub-mullvad setup 1234567890123456 de   # Germany"
+        echo "  parahub-mullvad setup 1234567890123456       # Auto-detect"
+        echo ""
+        echo "Countries: us gb de nl se pt fr es ch at it jp sg br ..."
+        exit 1
+    fi
+
+    # Auto-detect country from WAN IP
+    if [ -z "$COUNTRY" ]; then
+        echo "Auto-detecting country from WAN IP..."
+        COUNTRY=$(curl -s --max-time 5 https://ipinfo.io/country 2>/dev/null | tr 'A-Z' 'a-z')
+        if [ -z "$COUNTRY" ] || [ ${#COUNTRY} -ne 2 ]; then
+            echo "Error: Could not detect country."
+            echo "Specify manually: parahub-mullvad setup $ACCOUNT <country>"
+            exit 1
+        fi
+        echo "Detected: $COUNTRY"
+    fi
+
+    COUNTRY=$(echo "$COUNTRY" | tr 'A-Z' 'a-z')
+
+    # --- Step 1: Generate WireGuard keys ---
+    echo "Generating WireGuard keys..."
+    umask 077
+    wg genkey > "$PARAHUB_DIR/wg_private.key"
+    wg pubkey < "$PARAHUB_DIR/wg_private.key" > "$PARAHUB_DIR/wg_public.key"
+
+    PRIVKEY=$(cat "$PARAHUB_DIR/wg_private.key")
+    PUBKEY=$(cat "$PARAHUB_DIR/wg_public.key")
+
+    # --- Step 2: Register with Mullvad API ---
+    echo "Registering key with Mullvad..."
+    RESULT=$(curl -s --max-time 15 -X POST https://api.mullvad.net/wg/ \
+        -d "account=$ACCOUNT" \
+        -d "pubkey=$PUBKEY")
+
+    if echo "$RESULT" | grep -q "^[0-9]"; then
+        MULLVAD_IPV4=$(echo "$RESULT" | cut -d',' -f1)
+        echo "Mullvad IP: $MULLVAD_IPV4"
+    else
+        echo "Error from Mullvad: $RESULT"
+        exit 1
+    fi
+
+    # --- Step 3: Find server in target country ---
+    echo "Finding Mullvad server in '$COUNTRY'..."
+    curl -s --max-time 15 https://api.mullvad.net/www/relays/wireguard/ | \
+        tr '{' '\n' | \
+        grep "\"country_code\":\"${COUNTRY}\"" | \
+        grep '"active":true' | \
+        head -1 > /tmp/mullvad_relay.tmp
+
+    if [ ! -s /tmp/mullvad_relay.tmp ]; then
+        echo "Error: No active WireGuard server for country '$COUNTRY'"
+        rm -f /tmp/mullvad_relay.tmp
+        exit 1
+    fi
+
+    SERVER_IP=$(sed 's/.*"ipv4_addr_in":"\([^"]*\)".*/\1/' /tmp/mullvad_relay.tmp)
+    SERVER_PUBKEY=$(sed 's/.*"pubkey":"\([^"]*\)".*/\1/' /tmp/mullvad_relay.tmp)
+    SERVER_HOST=$(sed 's/.*"hostname":"\([^"]*\)".*/\1/' /tmp/mullvad_relay.tmp)
+    rm -f /tmp/mullvad_relay.tmp
+
+    echo "Server: $SERVER_HOST ($SERVER_IP)"
+
+    # --- Step 4: Clean previous config ---
+    uci -q delete network.mullvad_local 2>/dev/null || true
+    while uci -q delete network.@wireguard_mullvad_local[0] 2>/dev/null; do :; done
+
+    # --- Step 5: Create WireGuard interface (routes in table 100) ---
+    echo "Configuring WireGuard..."
+    uci batch <<-WG_EOF
+set network.mullvad_local=interface
+set network.mullvad_local.proto='wireguard'
+set network.mullvad_local.private_key='${PRIVKEY}'
+add_list network.mullvad_local.addresses='${MULLVAD_IPV4}'
+set network.mullvad_local.mtu='1420'
+set network.mullvad_local.ip4table='100'
+
+add network wireguard_mullvad_local
+set network.@wireguard_mullvad_local[-1].public_key='${SERVER_PUBKEY}'
+set network.@wireguard_mullvad_local[-1].endpoint_host='${SERVER_IP}'
+set network.@wireguard_mullvad_local[-1].endpoint_port='51820'
+add_list network.@wireguard_mullvad_local[-1].allowed_ips='0.0.0.0/0'
+set network.@wireguard_mullvad_local[-1].route_allowed_ips='1'
+set network.@wireguard_mullvad_local[-1].persistent_keepalive='25'
+WG_EOF
+
+    # Disable GRE6 tunnel (WG replaces it in table 100)
+    uci set network.vpn_tunnel.auto='0'
+    uci commit network
+
+    # --- Step 6: Firewall zone for mullvad_local ---
+    local zone_idx
+    if zone_idx=$(find_zone_index "mullvad_local"); then
+        uci delete "firewall.@zone[$zone_idx]"
+    fi
+
+    uci batch <<-FW_EOF
+add firewall zone
+set firewall.@zone[-1].name='mullvad_local'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='mullvad_local'
+FW_EOF
+
+    # Switch guest forwarding to mullvad_local
+    local fwd_idx
+    if fwd_idx=$(find_guest_forwarding); then
+        uci set "firewall.@forwarding[$fwd_idx].dest=mullvad_local"
+    fi
+    uci commit firewall
+
+    # --- Step 7: Save config ---
+    cat > "$ACCOUNT_FILE" <<-ACCT_EOF
+MULLVAD_ACCOUNT=${ACCOUNT}
+MULLVAD_COUNTRY=${COUNTRY}
+MULLVAD_SERVER=${SERVER_HOST}
+MULLVAD_SERVER_IP=${SERVER_IP}
+MULLVAD_LOCAL_IP=${MULLVAD_IPV4}
+ACCT_EOF
+    chmod 600 "$ACCOUNT_FILE"
+
+    # --- Step 8: Apply ---
+    echo "Restarting network..."
+    /etc/init.d/network restart
+    /etc/init.d/firewall restart
+
+    echo ""
+    echo "Done! Guest traffic now routes directly through Mullvad."
+    echo "Server: $SERVER_HOST ($COUNTRY)"
+    echo "Test: connect to Parahub_Free, visit https://am.i.mullvad.net"
+}
+
+# ============================================================================
+# status
+# ============================================================================
+
+cmd_status() {
+    echo "=== Parahub Mesh VPN Status ==="
+    echo ""
+
+    if [ -f "$ACCOUNT_FILE" ]; then
+        echo "Mode: LOCAL MULLVAD (direct)"
+        cat "$ACCOUNT_FILE"
+        echo ""
+        wg show mullvad_local 2>/dev/null || echo "WireGuard interface: not up"
+    else
+        echo "Mode: VPS GATEWAY (GRE6 tunnel)"
+        echo "VPS: 91.98.123.238 -> Mullvad Portugal"
+    fi
+
+    echo ""
+    echo "Guest forwarding:"
+    local fwd_idx
+    if fwd_idx=$(find_guest_forwarding); then
+        echo "  guest -> $(uci -q get "firewall.@forwarding[$fwd_idx].dest")"
+    fi
+}
+
+# ============================================================================
+# remove
+# ============================================================================
+
+cmd_remove() {
+    if [ ! -f "$ACCOUNT_FILE" ]; then
+        echo "No local Mullvad configured. Nothing to remove."
+        exit 0
+    fi
+
+    echo "Removing local Mullvad, reverting to VPS gateway..."
+
+    # Remove WireGuard interface
+    uci -q delete network.mullvad_local 2>/dev/null || true
+    while uci -q delete network.@wireguard_mullvad_local[0] 2>/dev/null; do :; done
+
+    # Re-enable GRE6 tunnel
+    uci -q delete network.vpn_tunnel.auto 2>/dev/null || true
+    uci commit network
+
+    # Remove firewall zone
+    local zone_idx
+    if zone_idx=$(find_zone_index "mullvad_local"); then
+        uci delete "firewall.@zone[$zone_idx]"
+    fi
+
+    # Switch guest forwarding back to vpn_tunnel
+    local fwd_idx
+    if fwd_idx=$(find_guest_forwarding); then
+        uci set "firewall.@forwarding[$fwd_idx].dest=vpn_tunnel"
+    fi
+    uci commit firewall
+
+    # Clean up files
+    rm -f "$PARAHUB_DIR/wg_private.key" "$PARAHUB_DIR/wg_public.key" "$ACCOUNT_FILE"
+
+    echo "Restarting network..."
+    /etc/init.d/network restart
+    /etc/init.d/firewall restart
+
+    echo "Done! Guest traffic now routes through VPS gateway."
+}
+
+# ============================================================================
+# Main
+# ============================================================================
+
+case "${1:-}" in
+    setup)
+        cmd_setup "$2" "${3:-}"
+        ;;
+    status)
+        cmd_status
+        ;;
+    remove)
+        cmd_remove
+        ;;
+    *)
+        echo "Parahub Mesh — Mullvad WireGuard Manager"
+        echo ""
+        echo "Commands:"
+        echo "  parahub-mullvad setup <account_key> [country]"
+        echo "  parahub-mullvad status"
+        echo "  parahub-mullvad remove"
+        echo ""
+        echo "By default, guest traffic goes through the VPS gateway."
+        echo "With 'setup', it routes directly through your own Mullvad"
+        echo "account — faster, and uses the nearest server."
+        ;;
+esac

files/usr/bin/parahub-speed-control

@@ -0,0 +1,74 @@
+#!/bin/sh
+# Parahub Mesh — Per-client speed control
+# Free tier: 512kbps (default), Paid tier: full speed (via nftables set + tc HTB)
+#
+# Usage: parahub-speed-control init|add <ip>|remove <ip>|list|flush
+
+IFACE="br-guest"
+SLOW_RATE="512kbit"
+
+case "$1" in
+  init)
+    # Remove SQM if active
+    /etc/init.d/sqm stop 2>/dev/null
+    /etc/init.d/sqm disable 2>/dev/null
+
+    # --- Egress shaping (router → client, i.e. download for client) ---
+    tc qdisc del dev $IFACE root 2>/dev/null
+    tc qdisc add dev $IFACE root handle 1: htb default 10
+    tc class add dev $IFACE parent 1: classid 1:1 htb rate 1000mbit
+    tc class add dev $IFACE parent 1:1 classid 1:10 htb rate $SLOW_RATE ceil $SLOW_RATE  # free tier
+    tc class add dev $IFACE parent 1:1 classid 1:20 htb rate 1000mbit                     # paid tier
+    tc qdisc add dev $IFACE parent 1:10 fq_codel
+    tc qdisc add dev $IFACE parent 1:20 fq_codel
+
+    # tc filter: packets with mark 0x20 → paid class
+    tc filter add dev $IFACE parent 1: protocol ip handle 0x20 fw flowid 1:20
+
+    # --- Ingress shaping (client → router, i.e. upload for client) via IFB ---
+    ip link add ifb-guest type ifb 2>/dev/null
+    ip link set ifb-guest up
+    tc qdisc del dev $IFACE ingress 2>/dev/null
+    tc qdisc add dev $IFACE ingress
+    tc filter add dev $IFACE parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev ifb-guest
+
+    tc qdisc del dev ifb-guest root 2>/dev/null
+    tc qdisc add dev ifb-guest root handle 1: htb default 10
+    tc class add dev ifb-guest parent 1: classid 1:1 htb rate 1000mbit
+    tc class add dev ifb-guest parent 1:1 classid 1:10 htb rate $SLOW_RATE ceil $SLOW_RATE
+    tc class add dev ifb-guest parent 1:1 classid 1:20 htb rate 1000mbit
+    tc qdisc add dev ifb-guest parent 1:10 fq_codel
+    tc qdisc add dev ifb-guest parent 1:20 fq_codel
+    tc filter add dev ifb-guest parent 1: protocol ip handle 0x20 fw flowid 1:20
+
+    # --- nftables: paid_clients set + mark rules ---
+    nft add table inet parahub 2>/dev/null
+    nft flush table inet parahub 2>/dev/null
+    nft add set inet parahub paid_clients '{ type ipv4_addr; }'
+    nft add chain inet parahub speed_mark '{ type filter hook forward priority -150; }'
+    nft add rule inet parahub speed_mark ip daddr @paid_clients meta mark set 0x20
+    nft add rule inet parahub speed_mark ip saddr @paid_clients meta mark set 0x20
+
+    logger -t parahub-speed "Speed control initialized: free=${SLOW_RATE}, paid=unlimited"
+    ;;
+  add)
+    [ -z "$2" ] && echo "Usage: $0 add <ip>" && exit 1
+    nft add element inet parahub paid_clients "{ $2 }" 2>/dev/null
+    logger -t parahub-speed "Added paid client: $2"
+    ;;
+  remove)
+    [ -z "$2" ] && echo "Usage: $0 remove <ip>" && exit 1
+    nft delete element inet parahub paid_clients "{ $2 }" 2>/dev/null
+    logger -t parahub-speed "Removed paid client: $2"
+    ;;
+  list)
+    nft list set inet parahub paid_clients 2>/dev/null
+    ;;
+  flush)
+    nft flush set inet parahub paid_clients 2>/dev/null
+    ;;
+  *)
+    echo "Usage: $0 {init|add <ip>|remove <ip>|list|flush}"
+    exit 1
+    ;;
+esac

scripts/build.sh

@@ -22,22 +22,42 @@ device_config() {
         axt1800)
             OPENWRT_TARGET="qualcommax/ipq60xx"
             PROFILE="glinet_gl-axt1800"
+            FIRMWARE_ROLE="bumblebee"
             ;;
         mt3000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="glinet_gl-mt3000"
+            FIRMWARE_ROLE="bumblebee"
             ;;
         mt6000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="glinet_gl-mt6000"
+            FIRMWARE_ROLE="bumblebee"
             ;;
         ax6s)
-            OPENWRT_TARGET="mediatek/filogic"
+            OPENWRT_TARGET="mediatek/mt7622"
             PROFILE="xiaomi_redmi-router-ax6s"
+            FIRMWARE_ROLE="bumblebee"
             ;;
         ax53u)
             OPENWRT_TARGET="ramips/mt7621"
             PROFILE="asus_rt-ax53u"
+            FIRMWARE_ROLE="bumblebee"
+            ;;
+        ar300m16)
+            OPENWRT_TARGET="ath79/generic"
+            PROFILE="glinet_gl-ar300m16"
+            FIRMWARE_ROLE="bee"
+            ;;
+        wr3000)
+            OPENWRT_TARGET="mediatek/filogic"
+            PROFILE="cudy_wr3000-v1"
+            FIRMWARE_ROLE="bee"
+            ;;
+        cpe710)
+            OPENWRT_TARGET="ath79/generic"
+            PROFILE="tplink_cpe710-v1"
+            FIRMWARE_ROLE="bee"
             ;;
         *)
             return 1
@@ -49,37 +69,32 @@ device_config() {
 # Packages
 # ============================================================================
 
-PACKAGES_CORE=(
-    # batman-adv mesh
+# Bee (L2 Transport): minimal mesh relay — no overlay, no guest isolation
+PACKAGES_BEE=(
     kmod-batman-adv
     batctl-full
-
-    # 802.11s mesh support (replace basic wpad, includes OWE)
     wpad-mesh-mbedtls
     -wpad-basic-mbedtls
-
-    # Yggdrasil overlay network
-    yggdrasil
-
-    # GRE6 tunnel (guest traffic → VPS gateway)
-    kmod-gre6
-
-    # DNS-over-HTTPS for guest privacy
-    https-dns-proxy
-
-    # SQM traffic shaping
-    sqm-scripts
-    kmod-sched-cake
-
-    # Management
     luci
-    luci-app-sqm
+    curl
 )
 
-PACKAGES_FULL=(
-    "${PACKAGES_CORE[@]}"
-
-    # Diagnostics
+# Bumblebee (L3 Gateway): full stack — overlay, VPN, guest isolation, diagnostics
+PACKAGES_BUMBLEBEE=(
+    kmod-batman-adv
+    batctl-full
+    wpad-mesh-mbedtls
+    -wpad-basic-mbedtls
+    yggdrasil
+    kmod-gre6
+    kmod-wireguard
+    wireguard-tools
+    luci-proto-wireguard
+    https-dns-proxy
+    tc-full
+    kmod-ifb
+    kmod-sched
+    luci
     tcpdump
     iperf3
     iwinfo
@@ -93,12 +108,19 @@ PACKAGES_FULL=(
 usage() {
     echo "Usage: $0 <device>"
     echo ""
-    echo "Devices:"
-    echo "  axt1800   GL.iNet GL-AXT1800 (Slate AX)    qualcommax/ipq60xx"
-    echo "  mt3000    GL.iNet GL-MT3000 (Beryl AX)      mediatek/filogic"
-    echo "  mt6000    GL.iNet GL-MT6000 (Flint 2)       mediatek/filogic"
-    echo "  ax6s      Xiaomi Redmi AX6S                 mediatek/filogic"
-    echo "  ax53u     Asus RT-AX53U                    ramips/mt7621"
+    echo "Devices:                                                          Role"
+    echo "  axt1800   GL.iNet GL-AXT1800 (Slate AX)    qualcommax/ipq60xx  Bumblebee"
+    echo "  mt3000    GL.iNet GL-MT3000 (Beryl AX)      mediatek/filogic   Bumblebee"
+    echo "  mt6000    GL.iNet GL-MT6000 (Flint 2)       mediatek/filogic   Bumblebee"
+    echo "  ax6s      Xiaomi Redmi AX6S                 mediatek/mt7622    Bumblebee"
+    echo "  ax53u     Asus RT-AX53U                    ramips/mt7621       Bumblebee"
+    echo "  ar300m16  GL.iNet GL-AR300M16-EXT (16MB)   ath79/generic       Bee"
+    echo "  wr3000    Cudy AX3000 (WR3000)              mediatek/filogic   Bee"
+    echo "  cpe710    TP-Link CPE710 v1 (5GHz outdoor)  ath79/generic      Bee"
+    echo ""
+    echo "Roles:"
+    echo "  Bumblebee  L3 Gateway — full stack (yggdrasil, VPN, guest isolation, SQM, DoH)"
+    echo "  Bee        L2 Transport — minimal mesh relay (batman-adv, luci, heartbeat)"
     echo ""
     echo "OpenWrt version: ${OPENWRT_VERSION} (override with OPENWRT_VERSION env var)"
     echo ""
@@ -136,18 +158,35 @@ download_builder() {
 build_firmware() {
     local dir
     dir="$(builder_dir)"
-    local packages="${PACKAGES_FULL[*]} ${PACKAGES_EXTRA:-}"
+
+    # Select package list by role
+    local packages
+    if [ "$FIRMWARE_ROLE" = "bee" ]; then
+        packages="${PACKAGES_BEE[*]} ${PACKAGES_EXTRA:-}"
+    else
+        packages="${PACKAGES_BUMBLEBEE[*]} ${PACKAGES_EXTRA:-}"
+    fi
+
+    # Create temp FILES dir with role marker
+    local tmpfiles
+    tmpfiles=$(mktemp -d)
+    cp -a "${PROJECT_DIR}/files/"* "$tmpfiles/"
+    mkdir -p "$tmpfiles/etc/parahub"
+    echo "$FIRMWARE_ROLE" > "$tmpfiles/etc/parahub/role"
 
     echo "Building firmware for profile: ${PROFILE}"
+    echo "Role: ${FIRMWARE_ROLE}"
     echo "Packages: ${packages}"
-    echo "Custom files: ${PROJECT_DIR}/files"
+    echo "Custom files: ${tmpfiles}"
 
     make -C "$dir" image \
         PROFILE="$PROFILE" \
         PACKAGES="$packages" \
-        FILES="${PROJECT_DIR}/files" \
+        FILES="$tmpfiles" \
         BIN_DIR="${PROJECT_DIR}/output"
 
+    rm -rf "$tmpfiles"
+
     echo ""
     echo "Build complete! Firmware images:"
     ls -lh "${PROJECT_DIR}/output/"*.bin 2>/dev/null || true
@@ -173,6 +212,7 @@ fi
 
 echo "=== Parahub Mesh Firmware Builder ==="
 echo "Device:  ${INPUT}"
+echo "Role:    ${FIRMWARE_ROLE}"
 echo "OpenWrt: ${OPENWRT_VERSION}"
 echo "Target:  ${OPENWRT_TARGET}"
 echo "Profile: ${PROFILE}"