feat: VPS WireGuard gateway auto-configuration (ph4)

- uci-defaults: WG keygen, vps_gateway interface+zone+forwarding
- heartbeat: sends wg_public_key, parses VPS config, calls vps-setup
- parahub-vps-setup: new script for auto-configuring VPS tunnel with
  OTA bootstrap support and idempotent state tracking
- parahub-mullvad: setup disables vps_gateway, remove re-enables it
  (fixes bug referencing non-existent vpn_tunnel interface)
- parahub-gw-check: works with both vps_gateway and mullvad_local
- sysupgrade.conf: preserves WG VPS keys across upgrades
- build.sh: bump PARAHUB_BUILD to 4

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/etc/init.d/parahub-vpn-tunnel

@@ -1,79 +0,0 @@
-#!/bin/sh /etc/rc.common
-# Parahub VPN Tunnel — Creates GRE6 tunnel over Yggdrasil for guest traffic
-# Runs after yggdrasil (START=95). OpenWrt 25.x lacks the netifd grev6 protocol
-# handler, so we create the tunnel manually with ip6gre.
-#
-# IMPORTANT: encaplimit must be "none" — Yggdrasil drops IPv6 packets with
-# Destination Options extension headers (added by default encaplimit 4).
-
-START=96
-STOP=10
-
-VPS_YGG="200:39f1:6a26:328a:d901:fbd2:d30d:faef"
-GRE_LOCAL_IP="172.16.0.2"
-GRE_GATEWAY="172.16.0.1"
-
-start() {
-    # Only for Bumblebee role
-    [ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || return 0
-
-    # Wait for Yggdrasil address (up to 60s)
-    local ygg_addr="" attempts=0
-    while [ $attempts -lt 30 ]; do
-        ygg_addr=$(ip -6 addr show dev ygg0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
-        [ -n "$ygg_addr" ] && break
-        attempts=$((attempts + 1))
-        sleep 2
-    done
-
-    if [ -z "$ygg_addr" ]; then
-        logger -t parahub-vpn "No Yggdrasil address after 60s, skipping GRE6 tunnel"
-        return 1
-    fi
-
-    # Create GRE6 tunnel (encaplimit none — critical for Yggdrasil compatibility)
-    ip -6 tunnel add gre6-vpn mode ip6gre \
-        remote "$VPS_YGG" \
-        local "$ygg_addr" \
-        encaplimit none
-    ip addr add ${GRE_LOCAL_IP}/24 dev gre6-vpn
-    ip link set gre6-vpn mtu 1400 up
-
-    # Default route through GRE (table 100 — used by guest policy routing)
-    ip route add default via "$GRE_GATEWAY" table 100
-
-    # Guest subnet direct route in table 100 (background — WiFi may not be up yet)
-    # Without this, router's own replies (source IP in guest subnet) go through
-    # GRE instead of back to the guest client (ip rule matches source-based)
-    local guest_subnet
-    guest_subnet=$(awk -F= '/GUEST_SUBNET/{print $2}' /etc/parahub/keys 2>/dev/null)
-    if [ -n "$guest_subnet" ]; then
-        # WiFi interfaces take time to come up at boot — retry in background
-        (
-            local guest_dev="" ga=0
-            while [ $ga -lt 30 ]; do
-                guest_dev=$(ip route | grep "^${guest_subnet} " | awk '{print $3}')
-                [ -n "$guest_dev" ] && break
-                ga=$((ga + 1))
-                sleep 2
-            done
-            if [ -n "$guest_dev" ]; then
-                ip route add "$guest_subnet" dev "$guest_dev" table 100 2>/dev/null
-                logger -t parahub-vpn "Guest route: $guest_subnet via $guest_dev in table 100"
-            else
-                logger -t parahub-vpn "Warning: guest device not found for $guest_subnet after 60s"
-            fi
-        ) &
-    fi
-
-    # Reload firewall so vpn_tunnel zone picks up gre6-vpn device
-    /etc/init.d/firewall reload 2>/dev/null &
-
-    logger -t parahub-vpn "GRE6 tunnel up: ${GRE_LOCAL_IP} → ${VPS_YGG} via $ygg_addr (encaplimit none)"
-}
-
-stop() {
-    ip route flush table 100 2>/dev/null
-    ip -6 tunnel del gre6-vpn 2>/dev/null
-    logger -t parahub-vpn "GRE6 tunnel down"
-}

files/etc/sysupgrade.conf

@@ -1,3 +1,6 @@
-/etc/parahub/
+/etc/parahub/keys
+/etc/parahub/role
+/etc/parahub/wg_vps_private.key
+/etc/parahub/wg_vps_public.key
 /etc/yggdrasil.conf
 /etc/dropbear/

files/etc/uci-defaults/99-parahub-mesh

@@ -4,7 +4,7 @@
 # It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
 #
 # Roles:
-#   bumblebee (L3 Gateway) — full stack: yggdrasil, GRE6, VPN, guest isolation, SQM, DoH
+#   bumblebee (L3 Gateway) — full stack: yggdrasil, Mullvad VPN, guest isolation, speed control, DoH
 #   bee (L2 Transport)     — minimal: batman-adv mesh relay, heartbeat
 
 # Read firmware role (written by build.sh)
@@ -21,8 +21,8 @@ BASE_MAC=$(cat /sys/class/net/br-lan/address 2>/dev/null || cat /sys/class/net/e
 NODE_SUFFIX=$(echo "$BASE_MAC" | awk -F: '{print toupper($5$6)}')
 
 HOSTNAME="Parahub-${NODE_SUFFIX}"
-PRIVATE_SSID="Parahub_${NODE_SUFFIX}"
-MESH_ID="parahub-mesh"
+PRIVATE_SSID="Parahub"
+MESH_ID="parahub.io/mesh"
 PUBLIC_SSID="parahub.io/free"
 
 # ============================================================================
@@ -52,9 +52,12 @@ GUEST_IP="10.${GUEST_O1}.${GUEST_O2}.1"
 # 3. KEY GENERATION
 # ============================================================================
 
-PRIVATE_KEY=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 12)
+# Shared private WiFi key — same on all nodes for seamless 802.11r roaming
+PRIVATE_KEY="parahub.io"
 # Shared mesh SAE key — same across all Parahub nodes for auto-peering
 MESH_KEY="ndIPclyqSn9LaCki"
+# Random root password for SSH + LuCI (unique per node)
+ROOT_PASSWORD=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 16)
 
 mkdir -p /etc/parahub
 cat > /etc/parahub/keys <<KEYS_EOF
@@ -68,9 +71,25 @@ PRIVATE_SSID=${PRIVATE_SSID}
 PRIVATE_SUBNET=${PRIV_SUBNET}/24
 GUEST_SUBNET=${GUEST_SUBNET}/24
 NODE_MAC=${BASE_MAC}
+ROOT_PASSWORD=${ROOT_PASSWORD}
 KEYS_EOF
 chmod 600 /etc/parahub/keys
 
+# Set root password (secures SSH + LuCI)
+echo -e "${ROOT_PASSWORD}\n${ROOT_PASSWORD}" | passwd root >/dev/null 2>&1
+
+# Ensure dropbear directory has strict permissions (required for key auth)
+chmod 700 /etc/dropbear
+
+# Generate WireGuard keypair for VPS gateway (Bumblebee only)
+if [ "$ROLE" != "bee" ]; then
+    if [ ! -f /etc/parahub/wg_vps_private.key ]; then
+        umask 077
+        wg genkey > /etc/parahub/wg_vps_private.key
+        wg pubkey < /etc/parahub/wg_vps_private.key > /etc/parahub/wg_vps_public.key
+    fi
+fi
+
 # ============================================================================
 # 4. NETWORK CONFIGURATION
 # ============================================================================
@@ -165,7 +184,7 @@ NET_EOF
     done
 
 else
-    # --- Bumblebee: full network (gw_mode=server, GRE6, guest, policy routing) ---
+    # --- Bumblebee: full network (gw_mode starts as client, promoted to server by gw-check when Mullvad is up) ---
     uci batch <<-NET_EOF
 # --- loopback ---
 set network.loopback=interface
@@ -174,14 +193,14 @@ set network.loopback.proto='static'
 set network.loopback.ipaddr='127.0.0.1'
 set network.loopback.netmask='255.0.0.0'
 
-# --- bat0 (batman-adv, server mode — acts as gateway for Bee nodes) ---
+# --- bat0 (batman-adv, starts as client — gw-check promotes to server when Mullvad is active) ---
 set network.bat0=interface
 set network.bat0.proto='batadv'
 set network.bat0.routing_algo='BATMAN_V'
 set network.bat0.aggregated_ogms='1'
 set network.bat0.bridge_loop_avoidance='1'
 set network.bat0.distributed_arp_table='1'
-set network.bat0.gw_mode='server'
+set network.bat0.gw_mode='client'
 set network.bat0.hop_penalty='15'
 set network.bat0.orig_interval='1000'
 
@@ -219,12 +238,15 @@ set network.wan=interface
 set network.wan.device='${WAN_DEV}'
 set network.wan.proto='dhcp'
 
-# --- VPN tunnel interface (device created by parahub-vpn-tunnel init script) ---
-set network.vpn_tunnel=interface
-set network.vpn_tunnel.device='gre6-vpn'
-set network.vpn_tunnel.proto='none'
+# --- VPS gateway WireGuard (disabled until heartbeat activates it) ---
+set network.vps_gateway=interface
+set network.vps_gateway.proto='wireguard'
+set network.vps_gateway.private_key_file='/etc/parahub/wg_vps_private.key'
+set network.vps_gateway.mtu='1420'
+set network.vps_gateway.ip4table='100'
+set network.vps_gateway.auto='0'
 
-# --- Policy routing: guest traffic → VPN table 100 ---
+# --- Policy routing: guest traffic → table 100 ---
 add network rule
 set network.@rule[-1].src='${GUEST_SUBNET}/24'
 set network.@rule[-1].lookup='100'
@@ -280,11 +302,21 @@ fi
 # Remove all existing wifi-iface sections
 while uci -q delete wireless.@wifi-iface[0]; do :; done
 
-# Enable radios (remove disabled flag)
+# Enable radios and set fixed channels (all nodes must share same channel for mesh peering)
 for radio in $RADIOS; do
     uci -q delete "wireless.${radio}.disabled" 2>/dev/null || true
 done
 
+# Fixed channels — all mesh nodes must be on the same channel per band
+# 2.4GHz: channel 1 (DFS-free, least congested of 1/6/11)
+# 5GHz: channel 36 (DFS-free, universal chipset support)
+if [ -n "$RADIO_2G" ]; then
+    uci set "wireless.${RADIO_2G}.channel=1"
+fi
+if [ -n "$RADIO_5G" ]; then
+    uci set "wireless.${RADIO_5G}.channel=36"
+fi
+
 # --- 2.4GHz radio: mesh backhaul + parahub.io/free AP ---
 if [ -n "$RADIO_2G" ]; then
     # Mesh interface on 2.4GHz
@@ -337,16 +369,39 @@ set wireless.mesh_5g.key='${MESH_KEY}'
 set wireless.mesh_5g.network='bat0_hardif_mesh1'
 WIFI_5G_MESH
 
-    # Private AP on 5GHz (better throughput)
+    # Private AP on 5GHz (better throughput, 802.11r/k/v for seamless roaming)
     uci batch <<-WIFI_5G_PRIV
 set wireless.private_5g=wifi-iface
 set wireless.private_5g.device='${RADIO_5G}'
 set wireless.private_5g.mode='ap'
 set wireless.private_5g.ssid='${PRIVATE_SSID}'
-set wireless.private_5g.encryption='sae'
+set wireless.private_5g.encryption='sae-mixed'
 set wireless.private_5g.key='${PRIVATE_KEY}'
 set wireless.private_5g.network='private'
+set wireless.private_5g.ieee80211r='1'
+set wireless.private_5g.ft_over_ds='0'
+set wireless.private_5g.ft_psk_generate_local='1'
+set wireless.private_5g.mobility_domain='0a01'
+set wireless.private_5g.ieee80211k='1'
+set wireless.private_5g.ieee80211v='1'
 WIFI_5G_PRIV
+
+    # Private AP on 2.4GHz (range: outdoor, through walls)
+    uci batch <<-WIFI_2G_PRIV
+set wireless.private_2g=wifi-iface
+set wireless.private_2g.device='${RADIO_2G}'
+set wireless.private_2g.mode='ap'
+set wireless.private_2g.ssid='${PRIVATE_SSID}'
+set wireless.private_2g.encryption='sae-mixed'
+set wireless.private_2g.key='${PRIVATE_KEY}'
+set wireless.private_2g.network='private'
+set wireless.private_2g.ieee80211r='1'
+set wireless.private_2g.ft_over_ds='0'
+set wireless.private_2g.ft_psk_generate_local='1'
+set wireless.private_2g.mobility_domain='0a01'
+set wireless.private_2g.ieee80211k='1'
+set wireless.private_2g.ieee80211v='1'
+WIFI_2G_PRIV
 fi
 
 uci commit wireless
@@ -405,7 +460,7 @@ set firewall.@rule[-1].target='ACCEPT'
 FW_EOF
 
 else
-    # --- Bumblebee: full firewall (4 zones, guest isolation, kill switch) ---
+    # --- Bumblebee: full firewall (3 zones + mullvad_local added by parahub-mullvad, guest kill switch) ---
     uci batch <<-FW_EOF
 # --- Zone: lan (private network) ---
 add firewall zone
@@ -433,25 +488,25 @@ set firewall.@zone[-1].masq='1'
 set firewall.@zone[-1].mtu_fix='1'
 add_list firewall.@zone[-1].network='wan'
 
-# --- Zone: vpn_tunnel (GRE6 → VPS → Mullvad) ---
-add firewall zone
-set firewall.@zone[-1].name='vpn_tunnel'
-set firewall.@zone[-1].input='REJECT'
-set firewall.@zone[-1].output='ACCEPT'
-set firewall.@zone[-1].forward='REJECT'
-set firewall.@zone[-1].masq='1'
-set firewall.@zone[-1].mtu_fix='1'
-add_list firewall.@zone[-1].network='vpn_tunnel'
-
 # --- Forwarding: lan → wan (internet for owner) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='lan'
 set firewall.@forwarding[-1].dest='wan'
 
-# --- Forwarding: guest → vpn_tunnel ONLY (kill switch: no wan!) ---
+# --- Zone: vps_gateway (default VPN exit for guests, activated by heartbeat) ---
+add firewall zone
+set firewall.@zone[-1].name='vps_gateway'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='vps_gateway'
+
+# --- Forwarding: guest → vps_gateway (active once heartbeat enables interface) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='guest'
-set firewall.@forwarding[-1].dest='vpn_tunnel'
+set firewall.@forwarding[-1].dest='vps_gateway'
 
 # --- Rule: guest DHCP (allow guests to get IP) ---
 add firewall rule
@@ -638,7 +693,7 @@ if [ "$ROLE" != "bee" ]; then
     # Generate unique keys for this node
     yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
 
-    # Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
+    # Add VPS as static Yggdrasil peer (management plane: remote access, heartbeat)
     sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
 
     # UCI network interface for yggdrasil TUN
@@ -674,13 +729,6 @@ set firewall.@rule[-1].proto='tcp'
 set firewall.@rule[-1].dest_port='80'
 set firewall.@rule[-1].target='ACCEPT'
 
-# Allow GRE6 protocol input (tunnel endpoint)
-add firewall rule
-set firewall.@rule[-1].name='Allow GRE6 input'
-set firewall.@rule[-1].src='yggdrasil'
-set firewall.@rule[-1].proto='47'
-set firewall.@rule[-1].target='ACCEPT'
-
 # Allow ICMPv6 on Yggdrasil
 add firewall rule
 set firewall.@rule[-1].name='Allow ICMPv6 Ygg'
@@ -705,9 +753,8 @@ set firewall.@forwarding[-1].dest='yggdrasil'
 YGG_FW_EOF
     uci commit firewall
 
-    # Enable yggdrasil service + VPN tunnel (creates GRE6 after yggdrasil starts)
+    # Enable yggdrasil service
     /etc/init.d/yggdrasil enable 2>/dev/null || true
-    /etc/init.d/parahub-vpn-tunnel enable 2>/dev/null || true
 
     # Save yggdrasil address to node keys file
     YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
@@ -753,9 +800,12 @@ fi
 
 chmod +x /usr/bin/parahub-heartbeat
 chmod +x /usr/bin/parahub-autoupdate
+chmod +x /usr/bin/parahub-gw-check
+chmod +x /usr/bin/parahub-vps-setup
 
-# Cron: heartbeat every 5 minutes + OTA update nightly at 3am
+# Cron: heartbeat every 5 min, gateway health check every 2 min, OTA nightly
 echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
+echo "*/2 * * * * /usr/bin/parahub-gw-check" >> /etc/crontabs/root
 echo "0 3 * * * /usr/bin/parahub-autoupdate" >> /etc/crontabs/root
 /etc/init.d/cron enable
 
@@ -776,10 +826,10 @@ else
     logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
     logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
     logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
-    logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
-    logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
+    logger -t parahub-mesh "Guest internet: VPS gateway (auto-configured via heartbeat)"
+    logger -t parahub-mesh "Optional: parahub-mullvad setup for lower latency"
     logger -t parahub-mesh "Guest IPv6: Yggdrasil SLAAC (full speed, firewall restricted)"
-    logger -t parahub-mesh "bat0 gw_mode: server (gateway for Bee nodes)"
+    logger -t parahub-mesh "bat0 gw_mode: client (promoted to server by gw-check when WireGuard active)"
 fi
 
 exit 0

files/usr/bin/parahub-gw-check

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Parahub Gateway Health Check
+# Monitors WireGuard status (VPS gateway or Mullvad) and switches batman-adv gw_mode:
+#   - WireGuard active (recent handshake) → gw_mode=server (advertise as gateway)
+#   - WireGuard down or not configured    → gw_mode=client (relay only)
+#
+# Run via cron every 2 minutes. Bumblebee only.
+
+[ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || exit 0
+
+# Check if any WireGuard interface has a recent handshake
+WG_OK=0
+if command -v wg >/dev/null 2>&1; then
+    # Get latest handshake timestamp from any WireGuard interface
+    LAST_HS=$(wg show all latest-handshakes 2>/dev/null | awk '{print $NF}' | sort -rn | head -1)
+    if [ -n "$LAST_HS" ] && [ "$LAST_HS" -gt 0 ] 2>/dev/null; then
+        NOW=$(date +%s)
+        AGE=$((NOW - LAST_HS))
+        # Handshake within last 5 minutes = alive
+        [ "$AGE" -lt 300 ] && WG_OK=1
+    fi
+fi
+
+CURRENT_MODE=$(batctl gw_mode 2>/dev/null | awk '{print $1}')
+
+if [ "$WG_OK" = "1" ]; then
+    if [ "$CURRENT_MODE" != "server" ]; then
+        batctl gw_mode server
+        logger -t parahub-gw "WireGuard active, switched to gw_mode=server"
+    fi
+else
+    if [ "$CURRENT_MODE" != "client" ]; then
+        batctl gw_mode client
+        logger -t parahub-gw "WireGuard down, switched to gw_mode=client"
+    fi
+fi

files/usr/bin/parahub-heartbeat

@@ -19,6 +19,12 @@ UPTIME="$(cut -d. -f1 /proc/uptime)"
 MESH_IP=$(ip -4 addr show br-private 2>/dev/null | grep -o 'inet [0-9.]*' | cut -d' ' -f2)
 MESH_IP="${MESH_IP:-unknown}"
 
+# Read WireGuard VPS public key (Bumblebee only)
+WG_PUBKEY=""
+if [ -f /etc/parahub/wg_vps_public.key ]; then
+    WG_PUBKEY=$(cat /etc/parahub/wg_vps_public.key 2>/dev/null)
+fi
+
 # Detect hardware from board_name
 HW=$(cat /tmp/sysinfo/board_name 2>/dev/null)
 case "$HW" in
@@ -33,7 +39,7 @@ case "$HW" in
 esac
 
 FW_VERSION=$(cat /etc/parahub/version 2>/dev/null || echo "unknown")
-PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"${FW_VERSION}\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\"}"
+PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"${FW_VERSION}\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\",\"wg_public_key\":\"${WG_PUBKEY}\"}"
 
 RESPONSE=""
 
@@ -70,3 +76,15 @@ if [ "$ROLE" != "bee" ] && [ -x /usr/bin/parahub-speed-control ] && [ -n "$RESPO
         parahub-speed-control add "$IP"
     done
 fi
+
+# VPS gateway auto-configuration (Bumblebee only, skip if Mullvad is configured)
+if [ "$ROLE" != "bee" ] && [ -n "$RESPONSE" ] && [ ! -f /etc/parahub/mullvad_account ]; then
+    VPS_ENDPOINT=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.endpoint' 2>/dev/null)
+    VPS_PUBKEY=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.public_key' 2>/dev/null)
+    VPS_IP=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.assigned_ip' 2>/dev/null)
+    VPS_KEEPALIVE=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.keepalive' 2>/dev/null)
+
+    if [ -n "$VPS_ENDPOINT" ] && [ -n "$VPS_PUBKEY" ] && [ -n "$VPS_IP" ]; then
+        /usr/bin/parahub-vps-setup "$VPS_ENDPOINT" "$VPS_PUBKEY" "$VPS_IP" "${VPS_KEEPALIVE:-25}"
+    fi
+fi

files/usr/bin/parahub-mullvad

@@ -3,7 +3,7 @@
 #
 # Allows the node owner to run Mullvad directly on the router.
 # Guest traffic routes through the local WireGuard tunnel instead of
-# the default GRE6→VPS path, giving lower latency and using the
+# the default VPS gateway path, giving lower latency and using the
 # nearest Mullvad server.
 #
 # Usage:
@@ -150,8 +150,8 @@ set network.@wireguard_mullvad_local[-1].route_allowed_ips='1'
 set network.@wireguard_mullvad_local[-1].persistent_keepalive='25'
 WG_EOF
 
-    # Disable GRE6 tunnel (WG replaces it in table 100)
-    uci set network.vpn_tunnel.auto='0'
+    # Disable VPS gateway (Mullvad replaces it in table 100)
+    uci -q set network.vps_gateway.auto='0' 2>/dev/null || true
     uci commit network
 
     # --- Step 6: Firewall zone for mullvad_local ---
@@ -213,8 +213,10 @@ cmd_status() {
         echo ""
         wg show mullvad_local 2>/dev/null || echo "WireGuard interface: not up"
     else
-        echo "Mode: VPS GATEWAY (GRE6 tunnel)"
-        echo "VPS: 91.98.123.238 -> Mullvad Portugal"
+        echo "Mode: VPS GATEWAY (WireGuard)"
+        echo "VPS: 185.47.131.84 -> Mullvad"
+        echo ""
+        wg show vps_gateway 2>/dev/null || echo "VPS gateway: not active"
     fi
 
     echo ""
@@ -222,6 +224,8 @@ cmd_status() {
     local fwd_idx
     if fwd_idx=$(find_guest_forwarding); then
         echo "  guest -> $(uci -q get "firewall.@forwarding[$fwd_idx].dest")"
+    else
+        echo "  (none)"
     fi
 }
 
@@ -241,8 +245,8 @@ cmd_remove() {
     uci -q delete network.mullvad_local 2>/dev/null || true
     while uci -q delete network.@wireguard_mullvad_local[0] 2>/dev/null; do :; done
 
-    # Re-enable GRE6 tunnel
-    uci -q delete network.vpn_tunnel.auto 2>/dev/null || true
+    # Re-enable VPS gateway
+    uci -q delete network.vps_gateway.auto 2>/dev/null || true
     uci commit network
 
     # Remove firewall zone
@@ -251,10 +255,10 @@ cmd_remove() {
         uci delete "firewall.@zone[$zone_idx]"
     fi
 
-    # Switch guest forwarding back to vpn_tunnel
+    # Switch guest forwarding back to vps_gateway
     local fwd_idx
     if fwd_idx=$(find_guest_forwarding); then
-        uci set "firewall.@forwarding[$fwd_idx].dest=vpn_tunnel"
+        uci set "firewall.@forwarding[$fwd_idx].dest=vps_gateway"
     fi
     uci commit firewall
 

files/usr/bin/parahub-vps-setup

@@ -0,0 +1,126 @@
+#!/bin/sh
+# Parahub Mesh — VPS WireGuard Gateway Setup
+# Called by heartbeat to auto-configure the VPS tunnel for guest internet.
+#
+# Usage: parahub-vps-setup <endpoint> <public_key> <assigned_ip> <keepalive>
+# Example: parahub-vps-setup 185.47.131.84:51820 <base64_key> 10.99.0.2/16 25
+
+ENDPOINT="$1"
+PUBKEY="$2"
+ASSIGNED_IP="$3"
+KEEPALIVE="${4:-25}"
+STATE_FILE="/tmp/vps_gateway_state"
+
+if [ -z "$ENDPOINT" ] || [ -z "$PUBKEY" ] || [ -z "$ASSIGNED_IP" ]; then
+    logger -t parahub-vps "Error: missing arguments"
+    exit 1
+fi
+
+# Check if config unchanged and interface is up — skip reconfiguration
+if [ -f "$STATE_FILE" ]; then
+    OLD_STATE=$(cat "$STATE_FILE")
+    NEW_STATE="${ENDPOINT}|${PUBKEY}|${ASSIGNED_IP}|${KEEPALIVE}"
+    if [ "$OLD_STATE" = "$NEW_STATE" ]; then
+        # Check if interface is actually up
+        if ip link show vps_gateway >/dev/null 2>&1; then
+            exit 0
+        fi
+    fi
+fi
+
+logger -t parahub-vps "Configuring VPS gateway: ${ENDPOINT} -> ${ASSIGNED_IP}"
+
+# Bootstrap: create interface + zone + forwarding if missing (OTA from pre-VPS firmware)
+if ! uci -q get network.vps_gateway >/dev/null 2>&1; then
+    logger -t parahub-vps "Bootstrap: creating vps_gateway interface (OTA upgrade)"
+    uci batch <<-BOOTSTRAP_NET
+set network.vps_gateway=interface
+set network.vps_gateway.proto='wireguard'
+set network.vps_gateway.private_key_file='/etc/parahub/wg_vps_private.key'
+set network.vps_gateway.mtu='1420'
+set network.vps_gateway.ip4table='100'
+BOOTSTRAP_NET
+    uci commit network
+fi
+
+# Bootstrap firewall zone if missing
+ZONE_EXISTS=0
+idx=0
+while uci -q get "firewall.@zone[$idx]" >/dev/null 2>&1; do
+    zname=$(uci -q get "firewall.@zone[$idx].name")
+    if [ "$zname" = "vps_gateway" ]; then
+        ZONE_EXISTS=1
+        break
+    fi
+    idx=$((idx + 1))
+done
+
+if [ "$ZONE_EXISTS" = "0" ]; then
+    logger -t parahub-vps "Bootstrap: creating vps_gateway firewall zone"
+    uci batch <<-BOOTSTRAP_FW
+add firewall zone
+set firewall.@zone[-1].name='vps_gateway'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='vps_gateway'
+BOOTSTRAP_FW
+
+    # Add guest → vps_gateway forwarding if no guest forwarding exists
+    FWD_EXISTS=0
+    fidx=0
+    while uci -q get "firewall.@forwarding[$fidx]" >/dev/null 2>&1; do
+        src=$(uci -q get "firewall.@forwarding[$fidx].src")
+        if [ "$src" = "guest" ]; then
+            FWD_EXISTS=1
+            break
+        fi
+        fidx=$((fidx + 1))
+    done
+
+    if [ "$FWD_EXISTS" = "0" ]; then
+        uci add firewall forwarding >/dev/null
+        uci set "firewall.@forwarding[-1].src=guest"
+        uci set "firewall.@forwarding[-1].dest=vps_gateway"
+    fi
+
+    uci commit firewall
+fi
+
+# Remove old peer sections
+while uci -q delete network.@wireguard_vps_gateway[0] 2>/dev/null; do :; done
+
+# Set address and add peer
+uci -q delete network.vps_gateway.addresses 2>/dev/null || true
+uci add_list network.vps_gateway.addresses="${ASSIGNED_IP}"
+
+# Split endpoint into host:port
+EP_HOST="${ENDPOINT%:*}"
+EP_PORT="${ENDPOINT##*:}"
+
+uci batch <<-PEER_EOF
+add network wireguard_vps_gateway
+set network.@wireguard_vps_gateway[-1].public_key='${PUBKEY}'
+set network.@wireguard_vps_gateway[-1].endpoint_host='${EP_HOST}'
+set network.@wireguard_vps_gateway[-1].endpoint_port='${EP_PORT}'
+add_list network.@wireguard_vps_gateway[-1].allowed_ips='0.0.0.0/0'
+set network.@wireguard_vps_gateway[-1].route_allowed_ips='1'
+set network.@wireguard_vps_gateway[-1].persistent_keepalive='${KEEPALIVE}'
+PEER_EOF
+
+# Enable interface (remove auto='0')
+uci -q delete network.vps_gateway.auto 2>/dev/null || true
+uci commit network
+
+# Bring up the interface (minimal restart)
+ifup vps_gateway 2>/dev/null
+
+# Reload firewall rules
+fw4 reload 2>/dev/null
+
+# Save state for next run
+echo "${ENDPOINT}|${PUBKEY}|${ASSIGNED_IP}|${KEEPALIVE}" > "$STATE_FILE"
+
+logger -t parahub-vps "VPS gateway activated: ${ASSIGNED_IP} via ${ENDPOINT}"

scripts/build.sh

@@ -11,6 +11,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 
 OPENWRT_VERSION="${OPENWRT_VERSION:-25.12.0-rc4}"
+PARAHUB_BUILD="4"
+FIRMWARE_VERSION="${OPENWRT_VERSION}-ph${PARAHUB_BUILD}"
 
 # ============================================================================
 # Device Database (device → target/subtarget + Image Builder profile)
@@ -174,7 +176,7 @@ build_firmware() {
     cp -a "${PROJECT_DIR}/files/"* "$tmpfiles/"
     mkdir -p "$tmpfiles/etc/parahub"
     echo "$FIRMWARE_ROLE" > "$tmpfiles/etc/parahub/role"
-    echo "$OPENWRT_VERSION" > "$tmpfiles/etc/parahub/version"
+    echo "$FIRMWARE_VERSION" > "$tmpfiles/etc/parahub/version"
     echo "$PROFILE" > "$tmpfiles/etc/parahub/profile"
     echo "$PORT_MAP" > "$tmpfiles/etc/parahub/port_map"
 
@@ -191,6 +193,9 @@ build_firmware() {
 
     rm -rf "$tmpfiles"
 
+    # Ensure output files are world-readable (served by nginx)
+    chmod 644 "${PROJECT_DIR}/output/"* 2>/dev/null || true
+
     echo ""
     echo "Build complete! Firmware images:"
     ls -lh "${PROJECT_DIR}/output/"*.bin 2>/dev/null || true
@@ -226,7 +231,7 @@ update_manifest() {
 import json, sys
 with open('$manifest') as f:
     m = json.load(f)
-m['version'] = '$OPENWRT_VERSION'
+m['version'] = '$FIRMWARE_VERSION'
 m.setdefault('devices', {})['$PROFILE'] = {
     'sysupgrade': '$filename',
     'sha256': '$sha256'
@@ -238,7 +243,7 @@ json.dump(m, sys.stdout, indent=2)
         python3 -c "
 import json, sys
 m = {
-    'version': '$OPENWRT_VERSION',
+    'version': '$FIRMWARE_VERSION',
     'devices': {
         '$PROFILE': {
             'sysupgrade': '$filename',