fix(wg): Use private_key instead of private_key_file (unsupported)

OpenWrt's WireGuard proto handler doesn't support private_key_file —
it auto-generates a new key, causing mismatch with the heartbeat pubkey.
Read key from file and set as inline private_key instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/etc/init.d/yggdrasil

@@ -0,0 +1,17 @@
+#!/bin/sh /etc/rc.common
+
+START=95
+STOP=10
+
+USE_PROCD=1
+CONF_FILE="/etc/yggdrasil.conf"
+
+start_service() {
+	[ -f "$CONF_FILE" ] || return 1
+	procd_open_instance
+	procd_set_param command /usr/sbin/yggdrasil -useconffile "$CONF_FILE"
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}

files/etc/sysupgrade.conf

@@ -0,0 +1,6 @@
+/etc/parahub/keys
+/etc/parahub/role
+/etc/parahub/wg_vps_private.key
+/etc/parahub/wg_vps_public.key
+/etc/yggdrasil.conf
+/etc/dropbear/

files/etc/uci-defaults/99-parahub-mesh

@@ -4,11 +4,9 @@
 # It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
 #
 # Roles:
-#   bumblebee (L3 Gateway) — full stack: yggdrasil, GRE6, VPN, guest isolation, SQM, DoH
+#   bumblebee (L3 Gateway) — full stack: yggdrasil, Mullvad VPN, guest isolation, speed control, DoH
 #   bee (L2 Transport)     — minimal: batman-adv mesh relay, heartbeat
 
-set -e
-
 # Read firmware role (written by build.sh)
 ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "bumblebee")
 
@@ -23,9 +21,9 @@ BASE_MAC=$(cat /sys/class/net/br-lan/address 2>/dev/null || cat /sys/class/net/e
 NODE_SUFFIX=$(echo "$BASE_MAC" | awk -F: '{print toupper($5$6)}')
 
 HOSTNAME="Parahub-${NODE_SUFFIX}"
-PRIVATE_SSID="Parahub_${NODE_SUFFIX}"
+PRIVATE_SSID="Parahub"
-MESH_ID="parahub-mesh"
+MESH_ID="parahub.io/mesh"
-PUBLIC_SSID="Parahub_Free"
+PUBLIC_SSID="parahub.io/free"
 
 # ============================================================================
 # 2. SUBNET GENERATION (collision avoidance from MAC octets)
@@ -54,9 +52,12 @@ GUEST_IP="10.${GUEST_O1}.${GUEST_O2}.1"
 # 3. KEY GENERATION
 # ============================================================================
 
-PRIVATE_KEY=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 12)
+# Shared private WiFi key — same on all nodes for seamless 802.11r roaming
+PRIVATE_KEY="parahub.io"
 # Shared mesh SAE key — same across all Parahub nodes for auto-peering
 MESH_KEY="ndIPclyqSn9LaCki"
+# Random root password for SSH + LuCI (unique per node)
+ROOT_PASSWORD=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 16)
 
 mkdir -p /etc/parahub
 cat > /etc/parahub/keys <<KEYS_EOF
@@ -70,13 +71,63 @@ PRIVATE_SSID=${PRIVATE_SSID}
 PRIVATE_SUBNET=${PRIV_SUBNET}/24
 GUEST_SUBNET=${GUEST_SUBNET}/24
 NODE_MAC=${BASE_MAC}
+ROOT_PASSWORD=${ROOT_PASSWORD}
 KEYS_EOF
 chmod 600 /etc/parahub/keys
 
+# Set root password (secures SSH + LuCI)
+echo -e "${ROOT_PASSWORD}\n${ROOT_PASSWORD}" | passwd root >/dev/null 2>&1
+
+# Ensure dropbear directory has strict permissions (required for key auth)
+chmod 700 /etc/dropbear
+
+# Generate WireGuard keypair for VPS gateway (Bumblebee only)
+if [ "$ROLE" != "bee" ]; then
+    if [ ! -f /etc/parahub/wg_vps_private.key ]; then
+        umask 077
+        wg genkey > /etc/parahub/wg_vps_private.key
+        wg pubkey < /etc/parahub/wg_vps_private.key > /etc/parahub/wg_vps_public.key
+    fi
+fi
+
 # ============================================================================
 # 4. NETWORK CONFIGURATION
 # ============================================================================
 
+# --- Port mapping (written by build.sh per device) ---
+PORT_MAP=$(cat /etc/parahub/port_map 2>/dev/null || echo "eth0:lan eth1:wan")
+if [ "$PORT_MAP" = "dsa" ]; then
+    # DSA switch (ax53u) — individual ports
+    LAN_PORTS="lan1 lan2 lan3 lan4"
+    WAN_DEV="wan"
+else
+    # Parse port map: "eth0:wan eth1:lan" → extract LAN and WAN
+    LAN_PORTS=""
+    WAN_DEV=""
+    for mapping in $PORT_MAP; do
+        port="${mapping%%:*}"
+        role="${mapping##*:}"
+        if [ "$role" = "lan" ]; then
+            LAN_PORTS="$port"
+        elif [ "$role" = "wan" ]; then
+            WAN_DEV="$port"
+        fi
+    done
+    [ -z "$LAN_PORTS" ] && LAN_PORTS="eth0"
+    [ -z "$WAN_DEV" ] && WAN_DEV="eth1"
+fi
+
+# Delete default OpenWrt br-lan/lan (conflicts with our br-private)
+uci -q delete network.lan 2>/dev/null || true
+# Find and delete br-lan device
+for i in 0 1 2 3 4; do
+    name=$(uci -q get "network.@device[$i].name" 2>/dev/null)
+    if [ "$name" = "br-lan" ]; then
+        uci delete "network.@device[$i]"
+        break
+    fi
+done
+
 if [ "$ROLE" = "bee" ]; then
     # --- Bee: minimal network (bat0 gw_mode=client, no GRE6, no guest, no policy routing) ---
     uci batch <<-NET_EOF
@@ -114,7 +165,6 @@ set network.private_dev.type='bridge'
 set network.private_dev.name='br-private'
 delete network.private_dev.ports
 add_list network.private_dev.ports='bat0'
-add_list network.private_dev.ports='eth0'
 
 set network.private=interface
 set network.private.device='br-private'
@@ -124,12 +174,17 @@ set network.private.netmask='255.255.255.0'
 
 # --- wan (DHCP, create if missing) ---
 set network.wan=interface
-set network.wan.device='eth1'
+set network.wan.device='${WAN_DEV}'
 set network.wan.proto='dhcp'
 NET_EOF
 
+    # Add LAN ports to private bridge (DSA: lan1-4, non-DSA: eth0)
+    for port in $LAN_PORTS; do
+        uci add_list network.private_dev.ports="$port"
+    done
+
 else
-    # --- Bumblebee: full network (gw_mode=server, GRE6, guest, policy routing) ---
+    # --- Bumblebee: full network (gw_mode starts as client, promoted to server by gw-check when Mullvad is up) ---
     uci batch <<-NET_EOF
 # --- loopback ---
 set network.loopback=interface
@@ -138,14 +193,14 @@ set network.loopback.proto='static'
 set network.loopback.ipaddr='127.0.0.1'
 set network.loopback.netmask='255.0.0.0'
 
-# --- bat0 (batman-adv, server mode — acts as gateway for Bee nodes) ---
+# --- bat0 (batman-adv, starts as client — gw-check promotes to server when Mullvad is active) ---
 set network.bat0=interface
 set network.bat0.proto='batadv'
 set network.bat0.routing_algo='BATMAN_V'
 set network.bat0.aggregated_ogms='1'
 set network.bat0.bridge_loop_avoidance='1'
 set network.bat0.distributed_arp_table='1'
-set network.bat0.gw_mode='server'
+set network.bat0.gw_mode='client'
 set network.bat0.hop_penalty='15'
 set network.bat0.orig_interval='1000'
 
@@ -165,7 +220,6 @@ set network.private_dev.type='bridge'
 set network.private_dev.name='br-private'
 delete network.private_dev.ports
 add_list network.private_dev.ports='bat0'
-add_list network.private_dev.ports='eth0'
 
 set network.private=interface
 set network.private.device='br-private'
@@ -181,25 +235,28 @@ set network.guest.netmask='255.255.255.0'
 
 # --- wan (DHCP, create if missing) ---
 set network.wan=interface
-set network.wan.device='eth1'
+set network.wan.device='${WAN_DEV}'
 set network.wan.proto='dhcp'
 
-# --- GRE6 tunnel (guest traffic → VPS gateway via Yggdrasil) ---
+# --- VPS gateway WireGuard (disabled until heartbeat activates it) ---
-set network.vpn_tunnel=interface
+set network.vps_gateway=interface
-set network.vpn_tunnel.proto='grev6'
+set network.vps_gateway.proto='wireguard'
-set network.vpn_tunnel.peeraddr='200:39f1:6a26:328a:d901:fbd2:d30d:faef'
+set network.vps_gateway.private_key='$(cat /etc/parahub/wg_vps_private.key)'
-set network.vpn_tunnel.ipaddr='172.16.0.2'
+set network.vps_gateway.mtu='1420'
-set network.vpn_tunnel.netmask='255.255.255.0'
+set network.vps_gateway.ip4table='100'
-set network.vpn_tunnel.gateway='172.16.0.1'
+set network.vps_gateway.auto='0'
-set network.vpn_tunnel.mtu='1400'
-set network.vpn_tunnel.ip4table='100'
 
-# --- Policy routing: guest traffic → VPN table 100 ---
+# --- Policy routing: guest traffic → table 100 ---
 add network rule
 set network.@rule[-1].src='${GUEST_SUBNET}/24'
 set network.@rule[-1].lookup='100'
 set network.@rule[-1].priority='100'
 NET_EOF
+
+    # Add LAN ports to private bridge (DSA: lan1-4, non-DSA: eth0)
+    for port in $LAN_PORTS; do
+        uci add_list network.private_dev.ports="$port"
+    done
 fi
 
 uci commit network
@@ -245,12 +302,22 @@ fi
 # Remove all existing wifi-iface sections
 while uci -q delete wireless.@wifi-iface[0]; do :; done
 
-# Enable radios (remove disabled flag)
+# Enable radios and set fixed channels (all nodes must share same channel for mesh peering)
 for radio in $RADIOS; do
     uci -q delete "wireless.${radio}.disabled" 2>/dev/null || true
 done
 
-# --- 2.4GHz radio: mesh backhaul + Parahub_Free AP ---
+# Fixed channels — all mesh nodes must be on the same channel per band
+# 2.4GHz: channel 1 (DFS-free, least congested of 1/6/11)
+# 5GHz: channel 36 (DFS-free, universal chipset support)
+if [ -n "$RADIO_2G" ]; then
+    uci set "wireless.${RADIO_2G}.channel=1"
+fi
+if [ -n "$RADIO_5G" ]; then
+    uci set "wireless.${RADIO_5G}.channel=36"
+fi
+
+# --- 2.4GHz radio: mesh backhaul + parahub.io/free AP ---
 if [ -n "$RADIO_2G" ]; then
     # Mesh interface on 2.4GHz
     uci batch <<-WIFI_2G_MESH
@@ -265,25 +332,23 @@ set wireless.mesh_2g.network='bat0_hardif_mesh0'
 WIFI_2G_MESH
 
     if [ "$ROLE" = "bee" ]; then
-        # Bee: Parahub_Free on private bridge (no guest isolation)
+        # Bee: parahub.io/free on private bridge (no guest isolation)
         uci batch <<-WIFI_2G_PUB
 set wireless.public_2g=wifi-iface
 set wireless.public_2g.device='${RADIO_2G}'
 set wireless.public_2g.mode='ap'
 set wireless.public_2g.ssid='${PUBLIC_SSID}'
-set wireless.public_2g.encryption='owe'
+set wireless.public_2g.encryption='none'
-set wireless.public_2g.owe_transition='1'
 set wireless.public_2g.network='private'
 WIFI_2G_PUB
     else
-        # Bumblebee: Parahub_Free on guest network (isolated)
+        # Bumblebee: parahub.io/free on guest network (isolated)
         uci batch <<-WIFI_2G_PUB
 set wireless.public_2g=wifi-iface
 set wireless.public_2g.device='${RADIO_2G}'
 set wireless.public_2g.mode='ap'
 set wireless.public_2g.ssid='${PUBLIC_SSID}'
-set wireless.public_2g.encryption='owe'
+set wireless.public_2g.encryption='none'
-set wireless.public_2g.owe_transition='1'
 set wireless.public_2g.isolate='1'
 set wireless.public_2g.network='guest'
 WIFI_2G_PUB
@@ -304,16 +369,39 @@ set wireless.mesh_5g.key='${MESH_KEY}'
 set wireless.mesh_5g.network='bat0_hardif_mesh1'
 WIFI_5G_MESH
 
-    # Private AP on 5GHz (better throughput)
+    # Private AP on 5GHz (better throughput, 802.11r/k/v for seamless roaming)
     uci batch <<-WIFI_5G_PRIV
 set wireless.private_5g=wifi-iface
 set wireless.private_5g.device='${RADIO_5G}'
 set wireless.private_5g.mode='ap'
 set wireless.private_5g.ssid='${PRIVATE_SSID}'
-set wireless.private_5g.encryption='sae'
+set wireless.private_5g.encryption='sae-mixed'
 set wireless.private_5g.key='${PRIVATE_KEY}'
 set wireless.private_5g.network='private'
+set wireless.private_5g.ieee80211r='1'
+set wireless.private_5g.ft_over_ds='0'
+set wireless.private_5g.ft_psk_generate_local='1'
+set wireless.private_5g.mobility_domain='0a01'
+set wireless.private_5g.ieee80211k='1'
+set wireless.private_5g.ieee80211v='1'
 WIFI_5G_PRIV
+
+    # Private AP on 2.4GHz (range: outdoor, through walls)
+    uci batch <<-WIFI_2G_PRIV
+set wireless.private_2g=wifi-iface
+set wireless.private_2g.device='${RADIO_2G}'
+set wireless.private_2g.mode='ap'
+set wireless.private_2g.ssid='${PRIVATE_SSID}'
+set wireless.private_2g.encryption='sae-mixed'
+set wireless.private_2g.key='${PRIVATE_KEY}'
+set wireless.private_2g.network='private'
+set wireless.private_2g.ieee80211r='1'
+set wireless.private_2g.ft_over_ds='0'
+set wireless.private_2g.ft_psk_generate_local='1'
+set wireless.private_2g.mobility_domain='0a01'
+set wireless.private_2g.ieee80211k='1'
+set wireless.private_2g.ieee80211v='1'
+WIFI_2G_PRIV
 fi
 
 uci commit wireless
@@ -372,7 +460,7 @@ set firewall.@rule[-1].target='ACCEPT'
 FW_EOF
 
 else
-    # --- Bumblebee: full firewall (4 zones, guest isolation, kill switch) ---
+    # --- Bumblebee: full firewall (3 zones + mullvad_local added by parahub-mullvad, guest kill switch) ---
     uci batch <<-FW_EOF
 # --- Zone: lan (private network) ---
 add firewall zone
@@ -382,13 +470,12 @@ set firewall.@zone[-1].output='ACCEPT'
 set firewall.@zone[-1].forward='ACCEPT'
 add_list firewall.@zone[-1].network='private'
 
-# --- Zone: guest (IPv4 only — IPv6 blocked) ---
+# --- Zone: guest (dual-stack — IPv6 for Yggdrasil services) ---
 add firewall zone
 set firewall.@zone[-1].name='guest'
 set firewall.@zone[-1].input='REJECT'
 set firewall.@zone[-1].output='ACCEPT'
 set firewall.@zone[-1].forward='REJECT'
-set firewall.@zone[-1].family='ipv4'
 add_list firewall.@zone[-1].network='guest'
 
 # --- Zone: wan ---
@@ -401,25 +488,25 @@ set firewall.@zone[-1].masq='1'
 set firewall.@zone[-1].mtu_fix='1'
 add_list firewall.@zone[-1].network='wan'
 
-# --- Zone: vpn_tunnel (GRE6 → VPS → Mullvad) ---
-add firewall zone
-set firewall.@zone[-1].name='vpn_tunnel'
-set firewall.@zone[-1].input='REJECT'
-set firewall.@zone[-1].output='ACCEPT'
-set firewall.@zone[-1].forward='REJECT'
-set firewall.@zone[-1].masq='1'
-set firewall.@zone[-1].mtu_fix='1'
-add_list firewall.@zone[-1].network='vpn_tunnel'
-
 # --- Forwarding: lan → wan (internet for owner) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='lan'
 set firewall.@forwarding[-1].dest='wan'
 
-# --- Forwarding: guest → vpn_tunnel ONLY (kill switch: no wan!) ---
+# --- Zone: vps_gateway (default VPN exit for guests, activated by heartbeat) ---
+add firewall zone
+set firewall.@zone[-1].name='vps_gateway'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='vps_gateway'
+
+# --- Forwarding: guest → vps_gateway (active once heartbeat enables interface) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='guest'
-set firewall.@forwarding[-1].dest='vpn_tunnel'
+set firewall.@forwarding[-1].dest='vps_gateway'
 
 # --- Rule: guest DHCP (allow guests to get IP) ---
 add firewall rule
@@ -430,14 +517,13 @@ set firewall.@rule[-1].dest_port='67'
 set firewall.@rule[-1].target='ACCEPT'
 set firewall.@rule[-1].family='ipv4'
 
-# --- Rule: guest DNS to router only (hijacked to DoH) ---
+# --- Rule: guest DNS to router (hijacked to DoH, dual-stack) ---
 add firewall rule
 set firewall.@rule[-1].name='Guest DNS'
 set firewall.@rule[-1].src='guest'
 set firewall.@rule[-1].proto='tcpudp'
 set firewall.@rule[-1].dest_port='53'
 set firewall.@rule[-1].target='ACCEPT'
-set firewall.@rule[-1].family='ipv4'
 
 # --- Rule: block guest → lan (isolation) ---
 add firewall rule
@@ -447,10 +533,20 @@ set firewall.@rule[-1].dest='lan'
 set firewall.@rule[-1].proto='all'
 set firewall.@rule[-1].target='REJECT'
 
-# --- Rule: block ALL IPv6 from guest (leak prevention) ---
+# --- Rule: allow guest DHCPv6/RA (IPv6 address assignment) ---
 add firewall rule
-set firewall.@rule[-1].name='Block guest IPv6'
+set firewall.@rule[-1].name='Guest RA'
 set firewall.@rule[-1].src='guest'
+set firewall.@rule[-1].proto='icmp'
+set firewall.@rule[-1].family='ipv6'
+set firewall.@rule[-1].icmp_type='router-solicitation'
+set firewall.@rule[-1].target='ACCEPT'
+
+# --- Rule: block guest IPv6 to WAN (only Yggdrasil allowed via forwarding) ---
+add firewall rule
+set firewall.@rule[-1].name='Block guest IPv6 WAN'
+set firewall.@rule[-1].src='guest'
+set firewall.@rule[-1].dest='wan'
 set firewall.@rule[-1].proto='all'
 set firewall.@rule[-1].family='ipv6'
 set firewall.@rule[-1].target='REJECT'
@@ -597,7 +693,7 @@ if [ "$ROLE" != "bee" ]; then
     # Generate unique keys for this node
     yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
 
-    # Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
+    # Add VPS as static Yggdrasil peer (management plane: remote access, heartbeat)
     sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
 
     # UCI network interface for yggdrasil TUN
@@ -608,12 +704,57 @@ set network.yggdrasil.proto='none'
 YGG_EOF
     uci commit network
 
-    # Add yggdrasil to LAN zone (mesh nodes trust each other)
+    # Yggdrasil firewall zone (separate from LAN — allows guest→yggdrasil forwarding)
-    uci add_list firewall.@zone[0].network='yggdrasil'
+    uci batch <<-YGG_FW_EOF
+add firewall zone
+set firewall.@zone[-1].name='yggdrasil'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+add_list firewall.@zone[-1].network='yggdrasil'
+
+# Allow SSH on Yggdrasil (remote management)
+add firewall rule
+set firewall.@rule[-1].name='Allow SSH Ygg'
+set firewall.@rule[-1].src='yggdrasil'
+set firewall.@rule[-1].proto='tcp'
+set firewall.@rule[-1].dest_port='22'
+set firewall.@rule[-1].target='ACCEPT'
+
+# Allow HTTP on Yggdrasil (LuCI)
+add firewall rule
+set firewall.@rule[-1].name='Allow HTTP Ygg'
+set firewall.@rule[-1].src='yggdrasil'
+set firewall.@rule[-1].proto='tcp'
+set firewall.@rule[-1].dest_port='80'
+set firewall.@rule[-1].target='ACCEPT'
+
+# Allow ICMPv6 on Yggdrasil
+add firewall rule
+set firewall.@rule[-1].name='Allow ICMPv6 Ygg'
+set firewall.@rule[-1].src='yggdrasil'
+set firewall.@rule[-1].proto='icmp'
+set firewall.@rule[-1].family='ipv6'
+set firewall.@rule[-1].target='ACCEPT'
+
+# Forwardings: LAN ↔ Yggdrasil (owner full access)
+add firewall forwarding
+set firewall.@forwarding[-1].src='lan'
+set firewall.@forwarding[-1].dest='yggdrasil'
+
+add firewall forwarding
+set firewall.@forwarding[-1].src='yggdrasil'
+set firewall.@forwarding[-1].dest='lan'
+
+# Forwarding: guest → yggdrasil (IPv6 Parahub services at full speed)
+add firewall forwarding
+set firewall.@forwarding[-1].src='guest'
+set firewall.@forwarding[-1].dest='yggdrasil'
+YGG_FW_EOF
     uci commit firewall
 
     # Enable yggdrasil service
-    /etc/init.d/yggdrasil enable
+    /etc/init.d/yggdrasil enable 2>/dev/null || true
 
     # Save yggdrasil address to node keys file
     YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
@@ -623,17 +764,53 @@ else
 fi
 
 # ============================================================================
-# 12. HEARTBEAT (phone-home to Parahub cloud)
+# 12. GUEST IPv6 VIA YGGDRASIL (Bumblebee only — full-speed Parahub access)
+# ============================================================================
+
+if [ "$ROLE" != "bee" ]; then
+    # Extract Yggdrasil 300::/64 subnet for guest SLAAC
+    YGG_SUBNET=$(yggdrasil -subnet -useconffile /etc/yggdrasil.conf 2>/dev/null)
+    # YGG_SUBNET format: 300:xxxx:xxxx:xxxx::/64
+    YGG_SUBNET_PREFIX="${YGG_SUBNET%%::*}"  # 300:xxxx:xxxx:xxxx
+
+    if [ -n "$YGG_SUBNET_PREFIX" ]; then
+        # Assign IPv6 from Yggdrasil subnet to guest interface
+        uci set network.guest.ip6addr="${YGG_SUBNET_PREFIX}::1/64"
+        uci commit network
+
+        # Configure RA/SLAAC for guest (odhcpd)
+        uci batch <<-GUEST6_EOF
+set dhcp.guest.ra='server'
+set dhcp.guest.dhcpv6='disabled'
+set dhcp.guest.ra_management='0'
+set dhcp.guest.ra_default='1'
+set dhcp.guest.ra_slaac='1'
+GUEST6_EOF
+        uci commit dhcp
+
+        logger -t parahub-mesh "Guest IPv6: ${YGG_SUBNET_PREFIX}::1/64 (SLAAC)"
+    else
+        logger -t parahub-mesh "Warning: Could not extract Yggdrasil subnet, guest IPv6 disabled"
+    fi
+fi
+
+# ============================================================================
+# 13. HEARTBEAT (phone-home to Parahub cloud)
 # ============================================================================
 
 chmod +x /usr/bin/parahub-heartbeat
+chmod +x /usr/bin/parahub-autoupdate
+chmod +x /usr/bin/parahub-gw-check
+chmod +x /usr/bin/parahub-vps-setup
 
-# Cron: every 5 minutes
+# Cron: heartbeat every 5 min, gateway health check every 2 min, OTA nightly
 echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
+echo "*/2 * * * * /usr/bin/parahub-gw-check" >> /etc/crontabs/root
+echo "0 3 * * * /usr/bin/parahub-autoupdate" >> /etc/crontabs/root
 /etc/init.d/cron enable
 
 # ============================================================================
-# 13. FINAL
+# 14. FINAL
 # ============================================================================
 
 # Log completion
@@ -643,15 +820,16 @@ logger -t parahub-mesh "Role: ${ROLE}"
 logger -t parahub-mesh "Private: ${PRIVATE_SSID} @ ${PRIV_IP}/24"
 
 if [ "$ROLE" = "bee" ]; then
-    logger -t parahub-mesh "Parahub_Free: bridged to private (no guest isolation)"
+    logger -t parahub-mesh "parahub.io/free: bridged to private (no guest isolation)"
     logger -t parahub-mesh "bat0 gw_mode: client (uses Bumblebee as gateway)"
 else
     logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
     logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
     logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
-    logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
+    logger -t parahub-mesh "Guest internet: VPS gateway (auto-configured via heartbeat)"
-    logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
+    logger -t parahub-mesh "Optional: parahub-mullvad setup for lower latency"
-    logger -t parahub-mesh "bat0 gw_mode: server (gateway for Bee nodes)"
+    logger -t parahub-mesh "Guest IPv6: Yggdrasil SLAAC (full speed, firewall restricted)"
+    logger -t parahub-mesh "bat0 gw_mode: client (promoted to server by gw-check when WireGuard active)"
 fi
 
 exit 0

files/usr/bin/parahub-autoupdate

@@ -0,0 +1,97 @@
+#!/bin/sh
+# Parahub Mesh — OTA Auto-Update
+# Checks manifest.json for new firmware, downloads and verifies, runs sysupgrade.
+# Runs nightly via cron. Lock file prevents concurrent runs.
+
+LOCK="/tmp/parahub-autoupdate.lock"
+MANIFEST_YGG="http://[200:abb9:5810:37d3:8a4c:98a6:b82b:969a]/firmware/manifest.json"
+MANIFEST_PUBLIC="https://parahub.io/firmware/manifest.json"
+FIRMWARE_YGG="http://[200:abb9:5810:37d3:8a4c:98a6:b82b:969a]/firmware"
+FIRMWARE_PUBLIC="https://parahub.io/firmware"
+
+# Lock — exit if already running
+if [ -f "$LOCK" ]; then
+    LOCK_PID=$(cat "$LOCK" 2>/dev/null)
+    if kill -0 "$LOCK_PID" 2>/dev/null; then
+        logger -t parahub-update "Already running (pid $LOCK_PID), exiting"
+        exit 0
+    fi
+    rm -f "$LOCK"
+fi
+echo $$ > "$LOCK"
+trap 'rm -f "$LOCK"' EXIT
+
+# Read current version and device profile
+CURRENT_VERSION=$(cat /etc/parahub/version 2>/dev/null)
+DEVICE_PROFILE=$(cat /etc/parahub/profile 2>/dev/null)
+ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "unknown")
+
+if [ -z "$CURRENT_VERSION" ] || [ -z "$DEVICE_PROFILE" ]; then
+    logger -t parahub-update "Missing /etc/parahub/version or /etc/parahub/profile, skipping"
+    exit 1
+fi
+
+# Fetch manifest (Yggdrasil first for bumblebee, public for bee)
+MANIFEST=""
+if [ "$ROLE" != "bee" ] && ping6 -c 1 -W 3 200:abb9:5810:37d3:8a4c:98a6:b82b:969a >/dev/null 2>&1; then
+    MANIFEST=$(curl -s -m 30 "$MANIFEST_YGG" 2>/dev/null)
+    BASE_URL="$FIRMWARE_YGG"
+fi
+
+if [ -z "$MANIFEST" ]; then
+    MANIFEST=$(curl -s -m 30 "$MANIFEST_PUBLIC" 2>/dev/null)
+    BASE_URL="$FIRMWARE_PUBLIC"
+fi
+
+if [ -z "$MANIFEST" ]; then
+    logger -t parahub-update "Failed to fetch manifest"
+    exit 1
+fi
+
+# Parse manifest with jsonfilter
+NEW_VERSION=$(echo "$MANIFEST" | jsonfilter -e '$.version' 2>/dev/null)
+SYSUPGRADE_FILE=$(echo "$MANIFEST" | jsonfilter -e "$.devices.${DEVICE_PROFILE}.sysupgrade" 2>/dev/null)
+EXPECTED_SHA256=$(echo "$MANIFEST" | jsonfilter -e "$.devices.${DEVICE_PROFILE}.sha256" 2>/dev/null)
+
+if [ -z "$NEW_VERSION" ]; then
+    logger -t parahub-update "Could not parse version from manifest"
+    exit 1
+fi
+
+if [ -z "$SYSUPGRADE_FILE" ] || [ -z "$EXPECTED_SHA256" ]; then
+    logger -t parahub-update "Device ${DEVICE_PROFILE} not found in manifest"
+    exit 0
+fi
+
+# Compare versions
+if [ "$CURRENT_VERSION" = "$NEW_VERSION" ]; then
+    logger -t parahub-update "Already up to date: ${CURRENT_VERSION}"
+    exit 0
+fi
+
+logger -t parahub-update "Update available: ${CURRENT_VERSION} → ${NEW_VERSION}"
+
+# Download firmware
+FIRMWARE_PATH="/tmp/firmware.bin"
+rm -f "$FIRMWARE_PATH"
+
+curl -s -m 600 -o "$FIRMWARE_PATH" "${BASE_URL}/${SYSUPGRADE_FILE}" 2>/dev/null
+
+if [ ! -f "$FIRMWARE_PATH" ]; then
+    logger -t parahub-update "Download failed: ${SYSUPGRADE_FILE}"
+    exit 1
+fi
+
+# Verify SHA256
+ACTUAL_SHA256=$(sha256sum "$FIRMWARE_PATH" | cut -d' ' -f1)
+
+if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
+    logger -t parahub-update "SHA256 mismatch! Expected: ${EXPECTED_SHA256}, Got: ${ACTUAL_SHA256}"
+    rm -f "$FIRMWARE_PATH"
+    exit 1
+fi
+
+logger -t parahub-update "SHA256 verified, starting sysupgrade to ${NEW_VERSION}..."
+
+# Run sysupgrade (preserves /etc/config/ by default + /etc/sysupgrade.conf entries)
+sysupgrade "$FIRMWARE_PATH"

files/usr/bin/parahub-gw-check

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Parahub Gateway Health Check
+# Monitors WireGuard status (VPS gateway or Mullvad) and switches batman-adv gw_mode:
+#   - WireGuard active (recent handshake) → gw_mode=server (advertise as gateway)
+#   - WireGuard down or not configured    → gw_mode=client (relay only)
+#
+# Run via cron every 2 minutes. Bumblebee only.
+
+[ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || exit 0
+
+# Check if any WireGuard interface has a recent handshake
+WG_OK=0
+if command -v wg >/dev/null 2>&1; then
+    # Get latest handshake timestamp from any WireGuard interface
+    LAST_HS=$(wg show all latest-handshakes 2>/dev/null | awk '{print $NF}' | sort -rn | head -1)
+    if [ -n "$LAST_HS" ] && [ "$LAST_HS" -gt 0 ] 2>/dev/null; then
+        NOW=$(date +%s)
+        AGE=$((NOW - LAST_HS))
+        # Handshake within last 5 minutes = alive
+        [ "$AGE" -lt 300 ] && WG_OK=1
+    fi
+fi
+
+CURRENT_MODE=$(batctl gw_mode 2>/dev/null | awk '{print $1}')
+
+if [ "$WG_OK" = "1" ]; then
+    if [ "$CURRENT_MODE" != "server" ]; then
+        batctl gw_mode server
+        logger -t parahub-gw "WireGuard active, switched to gw_mode=server"
+    fi
+else
+    if [ "$CURRENT_MODE" != "client" ]; then
+        batctl gw_mode client
+        logger -t parahub-gw "WireGuard down, switched to gw_mode=client"
+    fi
+fi

files/usr/bin/parahub-heartbeat

@@ -19,6 +19,20 @@ UPTIME="$(cut -d. -f1 /proc/uptime)"
 MESH_IP=$(ip -4 addr show br-private 2>/dev/null | grep -o 'inet [0-9.]*' | cut -d' ' -f2)
 MESH_IP="${MESH_IP:-unknown}"
 
+# Generate WireGuard VPS keypair if missing (OTA from pre-VPS firmware)
+if [ "$ROLE" != "bee" ] && [ ! -f /etc/parahub/wg_vps_private.key ] && command -v wg >/dev/null 2>&1; then
+    umask 077
+    wg genkey > /etc/parahub/wg_vps_private.key
+    wg pubkey < /etc/parahub/wg_vps_private.key > /etc/parahub/wg_vps_public.key
+    logger -t parahub-heartbeat "Generated VPS WireGuard keypair (OTA migration)"
+fi
+
+# Read WireGuard VPS public key (Bumblebee only)
+WG_PUBKEY=""
+if [ -f /etc/parahub/wg_vps_public.key ]; then
+    WG_PUBKEY=$(cat /etc/parahub/wg_vps_public.key 2>/dev/null)
+fi
+
 # Detect hardware from board_name
 HW=$(cat /tmp/sysinfo/board_name 2>/dev/null)
 case "$HW" in
@@ -32,7 +46,8 @@ case "$HW" in
     *) HW="${HW:-unknown}" ;;
 esac
 
-PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"25.12.0-rc4\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\"}"
+FW_VERSION=$(cat /etc/parahub/version 2>/dev/null || echo "unknown")
+PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"${FW_VERSION}\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\",\"wg_public_key\":\"${WG_PUBKEY}\"}"
 
 RESPONSE=""
 
@@ -69,3 +84,15 @@ if [ "$ROLE" != "bee" ] && [ -x /usr/bin/parahub-speed-control ] && [ -n "$RESPO
         parahub-speed-control add "$IP"
     done
 fi
+
+# VPS gateway auto-configuration (Bumblebee only, skip if Mullvad is configured)
+if [ "$ROLE" != "bee" ] && [ -n "$RESPONSE" ] && [ ! -f /etc/parahub/mullvad_account ]; then
+    VPS_ENDPOINT=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.endpoint' 2>/dev/null)
+    VPS_PUBKEY=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.public_key' 2>/dev/null)
+    VPS_IP=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.assigned_ip' 2>/dev/null)
+    VPS_KEEPALIVE=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.keepalive' 2>/dev/null)
+
+    if [ -n "$VPS_ENDPOINT" ] && [ -n "$VPS_PUBKEY" ] && [ -n "$VPS_IP" ]; then
+        /usr/bin/parahub-vps-setup "$VPS_ENDPOINT" "$VPS_PUBKEY" "$VPS_IP" "${VPS_KEEPALIVE:-25}"
+    fi
+fi

files/usr/bin/parahub-mullvad

@@ -3,7 +3,7 @@
 #
 # Allows the node owner to run Mullvad directly on the router.
 # Guest traffic routes through the local WireGuard tunnel instead of
-# the default GRE6→VPS path, giving lower latency and using the
+# the default VPS gateway path, giving lower latency and using the
 # nearest Mullvad server.
 #
 # Usage:
@@ -61,9 +61,9 @@ cmd_setup() {
         echo "Usage: parahub-mullvad setup <account_key> [country_code]"
         echo ""
         echo "Examples:"
-        echo "  parahub-mullvad setup 3032661375392987 pt   # Portugal"
+        echo "  parahub-mullvad setup 1234567890123456 pt   # Portugal"
-        echo "  parahub-mullvad setup 3032661375392987 de   # Germany"
+        echo "  parahub-mullvad setup 1234567890123456 de   # Germany"
-        echo "  parahub-mullvad setup 3032661375392987       # Auto-detect"
+        echo "  parahub-mullvad setup 1234567890123456       # Auto-detect"
         echo ""
         echo "Countries: us gb de nl se pt fr es ch at it jp sg br ..."
         exit 1
@@ -95,8 +95,8 @@ cmd_setup() {
     # --- Step 2: Register with Mullvad API ---
     echo "Registering key with Mullvad..."
     RESULT=$(curl -s --max-time 15 -X POST https://api.mullvad.net/wg/ \
-        -d "account=$ACCOUNT" \
+        --data-urlencode "account=$ACCOUNT" \
-        -d "pubkey=$PUBKEY")
+        --data-urlencode "pubkey=$PUBKEY")
 
     if echo "$RESULT" | grep -q "^[0-9]"; then
         MULLVAD_IPV4=$(echo "$RESULT" | cut -d',' -f1)
@@ -150,8 +150,8 @@ set network.@wireguard_mullvad_local[-1].route_allowed_ips='1'
 set network.@wireguard_mullvad_local[-1].persistent_keepalive='25'
 WG_EOF
 
-    # Disable GRE6 tunnel (WG replaces it in table 100)
+    # Disable VPS gateway (Mullvad replaces it in table 100)
-    uci set network.vpn_tunnel.auto='0'
+    uci -q set network.vps_gateway.auto='0' 2>/dev/null || true
     uci commit network
 
     # --- Step 6: Firewall zone for mullvad_local ---
@@ -196,7 +196,7 @@ ACCT_EOF
     echo ""
     echo "Done! Guest traffic now routes directly through Mullvad."
     echo "Server: $SERVER_HOST ($COUNTRY)"
-    echo "Test: connect to Parahub_Free, visit https://am.i.mullvad.net"
+    echo "Test: connect to parahub.io/free, visit https://am.i.mullvad.net"
 }
 
 # ============================================================================
@@ -213,8 +213,10 @@ cmd_status() {
         echo ""
         wg show mullvad_local 2>/dev/null || echo "WireGuard interface: not up"
     else
-        echo "Mode: VPS GATEWAY (GRE6 tunnel)"
+        echo "Mode: VPS GATEWAY (WireGuard)"
-        echo "VPS: 91.98.123.238 -> Mullvad Portugal"
+        echo "VPS: 185.47.131.84 -> Mullvad"
+        echo ""
+        wg show vps_gateway 2>/dev/null || echo "VPS gateway: not active"
     fi
 
     echo ""
@@ -222,6 +224,8 @@ cmd_status() {
     local fwd_idx
     if fwd_idx=$(find_guest_forwarding); then
         echo "  guest -> $(uci -q get "firewall.@forwarding[$fwd_idx].dest")"
+    else
+        echo "  (none)"
     fi
 }
 
@@ -241,8 +245,8 @@ cmd_remove() {
     uci -q delete network.mullvad_local 2>/dev/null || true
     while uci -q delete network.@wireguard_mullvad_local[0] 2>/dev/null; do :; done
 
-    # Re-enable GRE6 tunnel
+    # Re-enable VPS gateway
-    uci -q delete network.vpn_tunnel.auto 2>/dev/null || true
+    uci -q delete network.vps_gateway.auto 2>/dev/null || true
     uci commit network
 
     # Remove firewall zone
@@ -251,10 +255,10 @@ cmd_remove() {
         uci delete "firewall.@zone[$zone_idx]"
     fi
 
-    # Switch guest forwarding back to vpn_tunnel
+    # Switch guest forwarding back to vps_gateway
     local fwd_idx
     if fwd_idx=$(find_guest_forwarding); then
-        uci set "firewall.@forwarding[$fwd_idx].dest=vpn_tunnel"
+        uci set "firewall.@forwarding[$fwd_idx].dest=vps_gateway"
     fi
     uci commit firewall
 

files/usr/bin/parahub-speed-control

@@ -25,12 +25,16 @@ case "$1" in
     # tc filter: packets with mark 0x20 → paid class
     tc filter add dev $IFACE parent 1: protocol ip handle 0x20 fw flowid 1:20
 
+    # Exempt ALL IPv6 from shaping — only Yggdrasil IPv6 reaches guests (firewall enforced)
+    tc filter add dev $IFACE parent 1: protocol ipv6 prio 1 u32 match u32 0 0 flowid 1:20
+
     # --- Ingress shaping (client → router, i.e. upload for client) via IFB ---
     ip link add ifb-guest type ifb 2>/dev/null
     ip link set ifb-guest up
     tc qdisc del dev $IFACE ingress 2>/dev/null
     tc qdisc add dev $IFACE ingress
     tc filter add dev $IFACE parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev ifb-guest
+    tc filter add dev $IFACE parent ffff: protocol ipv6 u32 match u32 0 0 action mirred egress redirect dev ifb-guest
 
     tc qdisc del dev ifb-guest root 2>/dev/null
     tc qdisc add dev ifb-guest root handle 1: htb default 10
@@ -41,6 +45,9 @@ case "$1" in
     tc qdisc add dev ifb-guest parent 1:20 fq_codel
     tc filter add dev ifb-guest parent 1: protocol ip handle 0x20 fw flowid 1:20
 
+    # Exempt ALL IPv6 from ingress shaping
+    tc filter add dev ifb-guest parent 1: protocol ipv6 prio 1 u32 match u32 0 0 flowid 1:20
+
     # --- nftables: paid_clients set + mark rules ---
     nft add table inet parahub 2>/dev/null
     nft flush table inet parahub 2>/dev/null

files/usr/bin/parahub-vps-setup

@@ -0,0 +1,126 @@
+#!/bin/sh
+# Parahub Mesh — VPS WireGuard Gateway Setup
+# Called by heartbeat to auto-configure the VPS tunnel for guest internet.
+#
+# Usage: parahub-vps-setup <endpoint> <public_key> <assigned_ip> <keepalive>
+# Example: parahub-vps-setup 185.47.131.84:51820 <base64_key> 10.99.0.2/16 25
+
+ENDPOINT="$1"
+PUBKEY="$2"
+ASSIGNED_IP="$3"
+KEEPALIVE="${4:-25}"
+STATE_FILE="/tmp/vps_gateway_state"
+
+if [ -z "$ENDPOINT" ] || [ -z "$PUBKEY" ] || [ -z "$ASSIGNED_IP" ]; then
+    logger -t parahub-vps "Error: missing arguments"
+    exit 1
+fi
+
+# Check if config unchanged and interface is up — skip reconfiguration
+if [ -f "$STATE_FILE" ]; then
+    OLD_STATE=$(cat "$STATE_FILE")
+    NEW_STATE="${ENDPOINT}|${PUBKEY}|${ASSIGNED_IP}|${KEEPALIVE}"
+    if [ "$OLD_STATE" = "$NEW_STATE" ]; then
+        # Check if interface is actually up
+        if ip link show vps_gateway >/dev/null 2>&1; then
+            exit 0
+        fi
+    fi
+fi
+
+logger -t parahub-vps "Configuring VPS gateway: ${ENDPOINT} -> ${ASSIGNED_IP}"
+
+# Bootstrap: create interface + zone + forwarding if missing (OTA from pre-VPS firmware)
+if ! uci -q get network.vps_gateway >/dev/null 2>&1; then
+    logger -t parahub-vps "Bootstrap: creating vps_gateway interface (OTA upgrade)"
+    uci batch <<-BOOTSTRAP_NET
+set network.vps_gateway=interface
+set network.vps_gateway.proto='wireguard'
+set network.vps_gateway.private_key='$(cat /etc/parahub/wg_vps_private.key)'
+set network.vps_gateway.mtu='1420'
+set network.vps_gateway.ip4table='100'
+BOOTSTRAP_NET
+    uci commit network
+fi
+
+# Bootstrap firewall zone if missing
+ZONE_EXISTS=0
+idx=0
+while uci -q get "firewall.@zone[$idx]" >/dev/null 2>&1; do
+    zname=$(uci -q get "firewall.@zone[$idx].name")
+    if [ "$zname" = "vps_gateway" ]; then
+        ZONE_EXISTS=1
+        break
+    fi
+    idx=$((idx + 1))
+done
+
+if [ "$ZONE_EXISTS" = "0" ]; then
+    logger -t parahub-vps "Bootstrap: creating vps_gateway firewall zone"
+    uci batch <<-BOOTSTRAP_FW
+add firewall zone
+set firewall.@zone[-1].name='vps_gateway'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='vps_gateway'
+BOOTSTRAP_FW
+
+    # Add guest → vps_gateway forwarding if no guest forwarding exists
+    FWD_EXISTS=0
+    fidx=0
+    while uci -q get "firewall.@forwarding[$fidx]" >/dev/null 2>&1; do
+        src=$(uci -q get "firewall.@forwarding[$fidx].src")
+        if [ "$src" = "guest" ]; then
+            FWD_EXISTS=1
+            break
+        fi
+        fidx=$((fidx + 1))
+    done
+
+    if [ "$FWD_EXISTS" = "0" ]; then
+        uci add firewall forwarding >/dev/null
+        uci set "firewall.@forwarding[-1].src=guest"
+        uci set "firewall.@forwarding[-1].dest=vps_gateway"
+    fi
+
+    uci commit firewall
+fi
+
+# Remove old peer sections
+while uci -q delete network.@wireguard_vps_gateway[0] 2>/dev/null; do :; done
+
+# Set address and add peer
+uci -q delete network.vps_gateway.addresses 2>/dev/null || true
+uci add_list network.vps_gateway.addresses="${ASSIGNED_IP}"
+
+# Split endpoint into host:port
+EP_HOST="${ENDPOINT%:*}"
+EP_PORT="${ENDPOINT##*:}"
+
+uci batch <<-PEER_EOF
+add network wireguard_vps_gateway
+set network.@wireguard_vps_gateway[-1].public_key='${PUBKEY}'
+set network.@wireguard_vps_gateway[-1].endpoint_host='${EP_HOST}'
+set network.@wireguard_vps_gateway[-1].endpoint_port='${EP_PORT}'
+add_list network.@wireguard_vps_gateway[-1].allowed_ips='0.0.0.0/0'
+set network.@wireguard_vps_gateway[-1].route_allowed_ips='1'
+set network.@wireguard_vps_gateway[-1].persistent_keepalive='${KEEPALIVE}'
+PEER_EOF
+
+# Enable interface (remove auto='0')
+uci -q delete network.vps_gateway.auto 2>/dev/null || true
+uci commit network
+
+# Bring up the interface (minimal restart)
+ifup vps_gateway 2>/dev/null
+
+# Reload firewall rules
+fw4 reload 2>/dev/null
+
+# Save state for next run
+echo "${ENDPOINT}|${PUBKEY}|${ASSIGNED_IP}|${KEEPALIVE}" > "$STATE_FILE"
+
+logger -t parahub-vps "VPS gateway activated: ${ASSIGNED_IP} via ${ENDPOINT}"

scripts/build.sh

@@ -11,6 +11,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 
 OPENWRT_VERSION="${OPENWRT_VERSION:-25.12.0-rc4}"
+PARAHUB_BUILD="4"
+FIRMWARE_VERSION="${OPENWRT_VERSION}-ph${PARAHUB_BUILD}"
 
 # ============================================================================
 # Device Database (device → target/subtarget + Image Builder profile)
@@ -23,36 +25,43 @@ device_config() {
             OPENWRT_TARGET="qualcommax/ipq60xx"
             PROFILE="glinet_gl-axt1800"
             FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="eth0:lan eth1:wan"
             ;;
         mt3000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="glinet_gl-mt3000"
             FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="eth0:wan eth1:lan"
             ;;
         mt6000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="glinet_gl-mt6000"
             FIRMWARE_ROLE="bumblebee"
-            ;;
+            PORT_MAP="eth0:wan eth1:lan"
-        ax6s)
-            OPENWRT_TARGET="mediatek/filogic"
-            PROFILE="xiaomi_redmi-router-ax6s"
-            FIRMWARE_ROLE="bumblebee"
             ;;
         ax53u)
             OPENWRT_TARGET="ramips/mt7621"
             PROFILE="asus_rt-ax53u"
             FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="dsa"
             ;;
         ar300m16)
             OPENWRT_TARGET="ath79/generic"
             PROFILE="glinet_gl-ar300m16"
             FIRMWARE_ROLE="bee"
+            PORT_MAP="eth0:lan eth1:wan"
             ;;
         wr3000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="cudy_wr3000-v1"
             FIRMWARE_ROLE="bee"
+            PORT_MAP="eth0:wan eth1:lan"
+            ;;
+        cpe710)
+            OPENWRT_TARGET="ath79/generic"
+            PROFILE="tplink_cpe710-v1"
+            FIRMWARE_ROLE="bee"
+            PORT_MAP="eth0:lan eth1:wan"
             ;;
         *)
             return 1
@@ -88,7 +97,7 @@ PACKAGES_BUMBLEBEE=(
     https-dns-proxy
     tc-full
     kmod-ifb
-    kmod-sched-htb
+    kmod-sched
     luci
     tcpdump
     iperf3
@@ -107,10 +116,10 @@ usage() {
     echo "  axt1800   GL.iNet GL-AXT1800 (Slate AX)    qualcommax/ipq60xx  Bumblebee"
     echo "  mt3000    GL.iNet GL-MT3000 (Beryl AX)      mediatek/filogic   Bumblebee"
     echo "  mt6000    GL.iNet GL-MT6000 (Flint 2)       mediatek/filogic   Bumblebee"
-    echo "  ax6s      Xiaomi Redmi AX6S                 mediatek/filogic   Bumblebee"
     echo "  ax53u     Asus RT-AX53U                    ramips/mt7621       Bumblebee"
     echo "  ar300m16  GL.iNet GL-AR300M16-EXT (16MB)   ath79/generic       Bee"
     echo "  wr3000    Cudy AX3000 (WR3000)              mediatek/filogic   Bee"
+    echo "  cpe710    TP-Link CPE710 v1 (5GHz outdoor)  ath79/generic      Bee"
     echo ""
     echo "Roles:"
     echo "  Bumblebee  L3 Gateway — full stack (yggdrasil, VPN, guest isolation, SQM, DoH)"
@@ -161,12 +170,15 @@ build_firmware() {
         packages="${PACKAGES_BUMBLEBEE[*]} ${PACKAGES_EXTRA:-}"
     fi
 
-    # Create temp FILES dir with role marker
+    # Create temp FILES dir with role marker + version/profile
     local tmpfiles
     tmpfiles=$(mktemp -d)
     cp -a "${PROJECT_DIR}/files/"* "$tmpfiles/"
     mkdir -p "$tmpfiles/etc/parahub"
     echo "$FIRMWARE_ROLE" > "$tmpfiles/etc/parahub/role"
+    echo "$FIRMWARE_VERSION" > "$tmpfiles/etc/parahub/version"
+    echo "$PROFILE" > "$tmpfiles/etc/parahub/profile"
+    echo "$PORT_MAP" > "$tmpfiles/etc/parahub/port_map"
 
     echo "Building firmware for profile: ${PROFILE}"
     echo "Role: ${FIRMWARE_ROLE}"
@@ -181,11 +193,73 @@ build_firmware() {
 
     rm -rf "$tmpfiles"
 
+    # Ensure output files are world-readable (served by nginx)
+    chmod 644 "${PROJECT_DIR}/output/"* 2>/dev/null || true
+
     echo ""
     echo "Build complete! Firmware images:"
     ls -lh "${PROJECT_DIR}/output/"*.bin 2>/dev/null || true
     ls -lh "${PROJECT_DIR}/output/"*.img* 2>/dev/null || true
     ls -lh "${PROJECT_DIR}/output/"*.itb 2>/dev/null || true
+
+    # Update manifest.json with this device's sysupgrade info
+    update_manifest
+}
+
+update_manifest() {
+    local manifest="${PROJECT_DIR}/output/manifest.json"
+    local sysupgrade_file sha256
+
+    # Find the sysupgrade.bin for this profile
+    sysupgrade_file=$(ls "${PROJECT_DIR}/output/"*"${PROFILE}"*-sysupgrade.bin 2>/dev/null | head -1)
+
+    if [ -z "$sysupgrade_file" ]; then
+        echo "Warning: No sysupgrade.bin found for ${PROFILE}, skipping manifest update"
+        return
+    fi
+
+    sha256=$(sha256sum "$sysupgrade_file" | cut -d' ' -f1)
+    local filename
+    filename=$(basename "$sysupgrade_file")
+
+    # Create or update manifest.json
+    if [ -f "$manifest" ]; then
+        # Update existing manifest — replace version + add/update device entry
+        local tmp
+        tmp=$(mktemp)
+        python3 -c "
+import json, sys
+with open('$manifest') as f:
+    m = json.load(f)
+m['version'] = '$FIRMWARE_VERSION'
+m.setdefault('devices', {})['$PROFILE'] = {
+    'sysupgrade': '$filename',
+    'sha256': '$sha256'
+}
+json.dump(m, sys.stdout, indent=2)
+" > "$tmp" && mv "$tmp" "$manifest"
+    else
+        # Create new manifest
+        python3 -c "
+import json, sys
+m = {
+    'version': '$FIRMWARE_VERSION',
+    'devices': {
+        '$PROFILE': {
+            'sysupgrade': '$filename',
+            'sha256': '$sha256'
+        }
+    }
+}
+json.dump(m, sys.stdout, indent=2)
+" > "$manifest"
+    fi
+
+    echo ""
+    echo "Manifest updated: ${manifest}"
+    echo "  Device: ${PROFILE}"
+    echo "  File:   ${filename}"
+    echo "  SHA256: ${sha256}"
 }
 
 # ============================================================================