fix(wg): Use private_key instead of private_key_file (unsupported)

OpenWrt's WireGuard proto handler doesn't support private_key_file —
it auto-generates a new key, causing mismatch with the heartbeat pubkey.
Read key from file and set as inline private_key instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/etc/dropbear/authorized_keys

@@ -1 +1,2 @@
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcethx5tVJWXTj4GjG7h75Fr3IKrwdkpBRc8sN6uRrA andrey.perliev@gmail.com
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBjS7Ii3+TQcZcUkzw4kHMqZ0omyBHPl6uD9y4c4ZWBM norn@parahub-ng

files/etc/init.d/yggdrasil

@@ -0,0 +1,17 @@
+#!/bin/sh /etc/rc.common
+
+START=95
+STOP=10
+
+USE_PROCD=1
+CONF_FILE="/etc/yggdrasil.conf"
+
+start_service() {
+	[ -f "$CONF_FILE" ] || return 1
+	procd_open_instance
+	procd_set_param command /usr/sbin/yggdrasil -useconffile "$CONF_FILE"
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}

files/etc/sysupgrade.conf

@@ -0,0 +1,6 @@
+/etc/parahub/keys
+/etc/parahub/role
+/etc/parahub/wg_vps_private.key
+/etc/parahub/wg_vps_public.key
+/etc/yggdrasil.conf
+/etc/dropbear/

files/etc/uci-defaults/99-parahub-mesh

@@ -2,8 +2,13 @@
 # Parahub Mesh Node — Zero-Touch First Boot Configuration
 # This script runs once on first boot via uci-defaults mechanism.
 # It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
+#
+# Roles:
+#   bumblebee (L3 Gateway) — full stack: yggdrasil, Mullvad VPN, guest isolation, speed control, DoH
+#   bee (L2 Transport)     — minimal: batman-adv mesh relay, heartbeat
 
-set -e
+# Read firmware role (written by build.sh)
+ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "bumblebee")
 
 # ============================================================================
 # 1. IDENTITY GENERATION
@@ -16,9 +21,9 @@ BASE_MAC=$(cat /sys/class/net/br-lan/address 2>/dev/null || cat /sys/class/net/e
 NODE_SUFFIX=$(echo "$BASE_MAC" | awk -F: '{print toupper($5$6)}')
 
 HOSTNAME="Parahub-${NODE_SUFFIX}"
-PRIVATE_SSID="Parahub_${NODE_SUFFIX}"
-MESH_ID="parahub-mesh"
-PUBLIC_SSID="Parahub_Free"
+PRIVATE_SSID="Parahub"
+MESH_ID="parahub.io/mesh"
+PUBLIC_SSID="parahub.io/free"
 
 # ============================================================================
 # 2. SUBNET GENERATION (collision avoidance from MAC octets)
@@ -47,14 +52,18 @@ GUEST_IP="10.${GUEST_O1}.${GUEST_O2}.1"
 # 3. KEY GENERATION
 # ============================================================================
 
-PRIVATE_KEY=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 12)
+# Shared private WiFi key — same on all nodes for seamless 802.11r roaming
+PRIVATE_KEY="parahub.io"
 # Shared mesh SAE key — same across all Parahub nodes for auto-peering
 MESH_KEY="ndIPclyqSn9LaCki"
+# Random root password for SSH + LuCI (unique per node)
+ROOT_PASSWORD=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 16)
 
 mkdir -p /etc/parahub
 cat > /etc/parahub/keys <<KEYS_EOF
 # Parahub Mesh Node Keys — Generated at first boot
 # Node: ${HOSTNAME}
+# Role: ${ROLE}
 # Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)
 PRIVATE_WIFI_KEY=${PRIVATE_KEY}
 MESH_SAE_KEY=${MESH_KEY}
@@ -62,15 +71,66 @@ PRIVATE_SSID=${PRIVATE_SSID}
 PRIVATE_SUBNET=${PRIV_SUBNET}/24
 GUEST_SUBNET=${GUEST_SUBNET}/24
 NODE_MAC=${BASE_MAC}
+ROOT_PASSWORD=${ROOT_PASSWORD}
 KEYS_EOF
 chmod 600 /etc/parahub/keys
 
+# Set root password (secures SSH + LuCI)
+echo -e "${ROOT_PASSWORD}\n${ROOT_PASSWORD}" | passwd root >/dev/null 2>&1
+
+# Ensure dropbear directory has strict permissions (required for key auth)
+chmod 700 /etc/dropbear
+
+# Generate WireGuard keypair for VPS gateway (Bumblebee only)
+if [ "$ROLE" != "bee" ]; then
+    if [ ! -f /etc/parahub/wg_vps_private.key ]; then
+        umask 077
+        wg genkey > /etc/parahub/wg_vps_private.key
+        wg pubkey < /etc/parahub/wg_vps_private.key > /etc/parahub/wg_vps_public.key
+    fi
+fi
+
 # ============================================================================
 # 4. NETWORK CONFIGURATION
 # ============================================================================
 
-# Clean existing network config (preserve wan)
-uci batch <<-NET_EOF
+# --- Port mapping (written by build.sh per device) ---
+PORT_MAP=$(cat /etc/parahub/port_map 2>/dev/null || echo "eth0:lan eth1:wan")
+if [ "$PORT_MAP" = "dsa" ]; then
+    # DSA switch (ax53u) — individual ports
+    LAN_PORTS="lan1 lan2 lan3 lan4"
+    WAN_DEV="wan"
+else
+    # Parse port map: "eth0:wan eth1:lan" → extract LAN and WAN
+    LAN_PORTS=""
+    WAN_DEV=""
+    for mapping in $PORT_MAP; do
+        port="${mapping%%:*}"
+        role="${mapping##*:}"
+        if [ "$role" = "lan" ]; then
+            LAN_PORTS="$port"
+        elif [ "$role" = "wan" ]; then
+            WAN_DEV="$port"
+        fi
+    done
+    [ -z "$LAN_PORTS" ] && LAN_PORTS="eth0"
+    [ -z "$WAN_DEV" ] && WAN_DEV="eth1"
+fi
+
+# Delete default OpenWrt br-lan/lan (conflicts with our br-private)
+uci -q delete network.lan 2>/dev/null || true
+# Find and delete br-lan device
+for i in 0 1 2 3 4; do
+    name=$(uci -q get "network.@device[$i].name" 2>/dev/null)
+    if [ "$name" = "br-lan" ]; then
+        uci delete "network.@device[$i]"
+        break
+    fi
+done
+
+if [ "$ROLE" = "bee" ]; then
+    # --- Bee: minimal network (bat0 gw_mode=client, no GRE6, no guest, no policy routing) ---
+    uci batch <<-NET_EOF
 # --- loopback ---
 set network.loopback=interface
 set network.loopback.device='lo'
@@ -78,14 +138,69 @@ set network.loopback.proto='static'
 set network.loopback.ipaddr='127.0.0.1'
 set network.loopback.netmask='255.0.0.0'
 
-# --- bat0 (batman-adv virtual interface) ---
+# --- bat0 (batman-adv, client mode — uses Bumblebee as gateway) ---
 set network.bat0=interface
 set network.bat0.proto='batadv'
 set network.bat0.routing_algo='BATMAN_V'
 set network.bat0.aggregated_ogms='1'
 set network.bat0.bridge_loop_avoidance='1'
 set network.bat0.distributed_arp_table='1'
-set network.bat0.gw_mode='off'
+set network.bat0.gw_mode='client'
+set network.bat0.hop_penalty='15'
+set network.bat0.orig_interval='1000'
+
+# --- bat0 hardif for mesh0 (2.4GHz mesh) ---
+set network.bat0_hardif_mesh0=interface
+set network.bat0_hardif_mesh0.proto='batadv_hardif'
+set network.bat0_hardif_mesh0.master='bat0'
+
+# --- bat0 hardif for mesh1 (5GHz mesh) ---
+set network.bat0_hardif_mesh1=interface
+set network.bat0_hardif_mesh1.proto='batadv_hardif'
+set network.bat0_hardif_mesh1.master='bat0'
+
+# --- private bridge (bat0 + LAN ethernet) ---
+set network.private_dev=device
+set network.private_dev.type='bridge'
+set network.private_dev.name='br-private'
+delete network.private_dev.ports
+add_list network.private_dev.ports='bat0'
+
+set network.private=interface
+set network.private.device='br-private'
+set network.private.proto='static'
+set network.private.ipaddr='${PRIV_IP}'
+set network.private.netmask='255.255.255.0'
+
+# --- wan (DHCP, create if missing) ---
+set network.wan=interface
+set network.wan.device='${WAN_DEV}'
+set network.wan.proto='dhcp'
+NET_EOF
+
+    # Add LAN ports to private bridge (DSA: lan1-4, non-DSA: eth0)
+    for port in $LAN_PORTS; do
+        uci add_list network.private_dev.ports="$port"
+    done
+
+else
+    # --- Bumblebee: full network (gw_mode starts as client, promoted to server by gw-check when Mullvad is up) ---
+    uci batch <<-NET_EOF
+# --- loopback ---
+set network.loopback=interface
+set network.loopback.device='lo'
+set network.loopback.proto='static'
+set network.loopback.ipaddr='127.0.0.1'
+set network.loopback.netmask='255.0.0.0'
+
+# --- bat0 (batman-adv, starts as client — gw-check promotes to server when Mullvad is active) ---
+set network.bat0=interface
+set network.bat0.proto='batadv'
+set network.bat0.routing_algo='BATMAN_V'
+set network.bat0.aggregated_ogms='1'
+set network.bat0.bridge_loop_avoidance='1'
+set network.bat0.distributed_arp_table='1'
+set network.bat0.gw_mode='client'
 set network.bat0.hop_penalty='15'
 set network.bat0.orig_interval='1000'
 
@@ -105,7 +220,6 @@ set network.private_dev.type='bridge'
 set network.private_dev.name='br-private'
 delete network.private_dev.ports
 add_list network.private_dev.ports='bat0'
-add_list network.private_dev.ports='eth0'
 
 set network.private=interface
 set network.private.device='br-private'
@@ -121,18 +235,30 @@ set network.guest.netmask='255.255.255.0'
 
 # --- wan (DHCP, create if missing) ---
 set network.wan=interface
-set network.wan.device='eth1'
+set network.wan.device='${WAN_DEV}'
 set network.wan.proto='dhcp'
 
-# --- GRE6 tunnel (guest traffic → VPS gateway via Yggdrasil) ---
-set network.vpn_tunnel=interface
-set network.vpn_tunnel.proto='grev6'
-set network.vpn_tunnel.peeraddr='200:39f1:6a26:328a:d901:fbd2:d30d:faef'
-set network.vpn_tunnel.ipaddr='172.16.0.2'
-set network.vpn_tunnel.netmask='255.255.255.0'
-set network.vpn_tunnel.gateway='172.16.0.1'
-set network.vpn_tunnel.mtu='1400'
+# --- VPS gateway WireGuard (disabled until heartbeat activates it) ---
+set network.vps_gateway=interface
+set network.vps_gateway.proto='wireguard'
+set network.vps_gateway.private_key='$(cat /etc/parahub/wg_vps_private.key)'
+set network.vps_gateway.mtu='1420'
+set network.vps_gateway.ip4table='100'
+set network.vps_gateway.auto='0'
+
+# --- Policy routing: guest traffic → table 100 ---
+add network rule
+set network.@rule[-1].src='${GUEST_SUBNET}/24'
+set network.@rule[-1].lookup='100'
+set network.@rule[-1].priority='100'
 NET_EOF
+
+    # Add LAN ports to private bridge (DSA: lan1-4, non-DSA: eth0)
+    for port in $LAN_PORTS; do
+        uci add_list network.private_dev.ports="$port"
+    done
+fi
+
 uci commit network
 
 # ============================================================================
@@ -176,12 +302,22 @@ fi
 # Remove all existing wifi-iface sections
 while uci -q delete wireless.@wifi-iface[0]; do :; done
 
-# Enable radios (remove disabled flag)
+# Enable radios and set fixed channels (all nodes must share same channel for mesh peering)
 for radio in $RADIOS; do
     uci -q delete "wireless.${radio}.disabled" 2>/dev/null || true
 done
 
-# --- 2.4GHz radio: mesh backhaul + Parahub_Free AP ---
+# Fixed channels — all mesh nodes must be on the same channel per band
+# 2.4GHz: channel 1 (DFS-free, least congested of 1/6/11)
+# 5GHz: channel 36 (DFS-free, universal chipset support)
+if [ -n "$RADIO_2G" ]; then
+    uci set "wireless.${RADIO_2G}.channel=1"
+fi
+if [ -n "$RADIO_5G" ]; then
+    uci set "wireless.${RADIO_5G}.channel=36"
+fi
+
+# --- 2.4GHz radio: mesh backhaul + parahub.io/free AP ---
 if [ -n "$RADIO_2G" ]; then
     # Mesh interface on 2.4GHz
     uci batch <<-WIFI_2G_MESH
@@ -195,18 +331,28 @@ set wireless.mesh_2g.key='${MESH_KEY}'
 set wireless.mesh_2g.network='bat0_hardif_mesh0'
 WIFI_2G_MESH
 
-    # Public AP on 2.4GHz (better range) — OWE transition mode
-    # Devices that support OWE get encrypted; legacy devices fall back to open
-    uci batch <<-WIFI_2G_PUB
+    if [ "$ROLE" = "bee" ]; then
+        # Bee: parahub.io/free on private bridge (no guest isolation)
+        uci batch <<-WIFI_2G_PUB
 set wireless.public_2g=wifi-iface
 set wireless.public_2g.device='${RADIO_2G}'
 set wireless.public_2g.mode='ap'
 set wireless.public_2g.ssid='${PUBLIC_SSID}'
-set wireless.public_2g.encryption='owe'
-set wireless.public_2g.owe_transition='1'
+set wireless.public_2g.encryption='none'
+set wireless.public_2g.network='private'
+WIFI_2G_PUB
+    else
+        # Bumblebee: parahub.io/free on guest network (isolated)
+        uci batch <<-WIFI_2G_PUB
+set wireless.public_2g=wifi-iface
+set wireless.public_2g.device='${RADIO_2G}'
+set wireless.public_2g.mode='ap'
+set wireless.public_2g.ssid='${PUBLIC_SSID}'
+set wireless.public_2g.encryption='none'
 set wireless.public_2g.isolate='1'
 set wireless.public_2g.network='guest'
 WIFI_2G_PUB
+    fi
 fi
 
 # --- 5GHz radio: mesh backhaul + Private AP ---
@@ -223,16 +369,39 @@ set wireless.mesh_5g.key='${MESH_KEY}'
 set wireless.mesh_5g.network='bat0_hardif_mesh1'
 WIFI_5G_MESH
 
-    # Private AP on 5GHz (better throughput)
+    # Private AP on 5GHz (better throughput, 802.11r/k/v for seamless roaming)
     uci batch <<-WIFI_5G_PRIV
 set wireless.private_5g=wifi-iface
 set wireless.private_5g.device='${RADIO_5G}'
 set wireless.private_5g.mode='ap'
 set wireless.private_5g.ssid='${PRIVATE_SSID}'
-set wireless.private_5g.encryption='sae'
+set wireless.private_5g.encryption='sae-mixed'
 set wireless.private_5g.key='${PRIVATE_KEY}'
 set wireless.private_5g.network='private'
+set wireless.private_5g.ieee80211r='1'
+set wireless.private_5g.ft_over_ds='0'
+set wireless.private_5g.ft_psk_generate_local='1'
+set wireless.private_5g.mobility_domain='0a01'
+set wireless.private_5g.ieee80211k='1'
+set wireless.private_5g.ieee80211v='1'
 WIFI_5G_PRIV
+
+    # Private AP on 2.4GHz (range: outdoor, through walls)
+    uci batch <<-WIFI_2G_PRIV
+set wireless.private_2g=wifi-iface
+set wireless.private_2g.device='${RADIO_2G}'
+set wireless.private_2g.mode='ap'
+set wireless.private_2g.ssid='${PRIVATE_SSID}'
+set wireless.private_2g.encryption='sae-mixed'
+set wireless.private_2g.key='${PRIVATE_KEY}'
+set wireless.private_2g.network='private'
+set wireless.private_2g.ieee80211r='1'
+set wireless.private_2g.ft_over_ds='0'
+set wireless.private_2g.ft_psk_generate_local='1'
+set wireless.private_2g.mobility_domain='0a01'
+set wireless.private_2g.ieee80211k='1'
+set wireless.private_2g.ieee80211v='1'
+WIFI_2G_PRIV
 fi
 
 uci commit wireless
@@ -247,7 +416,9 @@ while uci -q delete firewall.@forwarding[0]; do :; done
 while uci -q delete firewall.@rule[0]; do :; done
 while uci -q delete firewall.@redirect[0]; do :; done
 
-uci batch <<-FW_EOF
+if [ "$ROLE" = "bee" ]; then
+    # --- Bee: minimal firewall (lan + wan only) ---
+    uci batch <<-FW_EOF
 # --- Zone: lan (private network) ---
 add firewall zone
 set firewall.@zone[-1].name='lan'
@@ -256,13 +427,55 @@ set firewall.@zone[-1].output='ACCEPT'
 set firewall.@zone[-1].forward='ACCEPT'
 add_list firewall.@zone[-1].network='private'
 
-# --- Zone: guest (IPv4 only — IPv6 blocked) ---
+# --- Zone: wan ---
+add firewall zone
+set firewall.@zone[-1].name='wan'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='wan'
+
+# --- Forwarding: lan → wan ---
+add firewall forwarding
+set firewall.@forwarding[-1].src='lan'
+set firewall.@forwarding[-1].dest='wan'
+
+# --- Standard WAN input rules ---
+add firewall rule
+set firewall.@rule[-1].name='Allow-DHCP-Renew'
+set firewall.@rule[-1].src='wan'
+set firewall.@rule[-1].proto='udp'
+set firewall.@rule[-1].dest_port='68'
+set firewall.@rule[-1].target='ACCEPT'
+set firewall.@rule[-1].family='ipv4'
+
+add firewall rule
+set firewall.@rule[-1].name='Allow-Ping'
+set firewall.@rule[-1].src='wan'
+set firewall.@rule[-1].proto='icmp'
+set firewall.@rule[-1].icmp_type='echo-request'
+set firewall.@rule[-1].target='ACCEPT'
+FW_EOF
+
+else
+    # --- Bumblebee: full firewall (3 zones + mullvad_local added by parahub-mullvad, guest kill switch) ---
+    uci batch <<-FW_EOF
+# --- Zone: lan (private network) ---
+add firewall zone
+set firewall.@zone[-1].name='lan'
+set firewall.@zone[-1].input='ACCEPT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='ACCEPT'
+add_list firewall.@zone[-1].network='private'
+
+# --- Zone: guest (dual-stack — IPv6 for Yggdrasil services) ---
 add firewall zone
 set firewall.@zone[-1].name='guest'
 set firewall.@zone[-1].input='REJECT'
 set firewall.@zone[-1].output='ACCEPT'
 set firewall.@zone[-1].forward='REJECT'
-set firewall.@zone[-1].family='ipv4'
 add_list firewall.@zone[-1].network='guest'
 
 # --- Zone: wan ---
@@ -275,25 +488,25 @@ set firewall.@zone[-1].masq='1'
 set firewall.@zone[-1].mtu_fix='1'
 add_list firewall.@zone[-1].network='wan'
 
-# --- Zone: vpn_tunnel (GRE6 → VPS → Mullvad) ---
-add firewall zone
-set firewall.@zone[-1].name='vpn_tunnel'
-set firewall.@zone[-1].input='REJECT'
-set firewall.@zone[-1].output='ACCEPT'
-set firewall.@zone[-1].forward='REJECT'
-set firewall.@zone[-1].masq='1'
-set firewall.@zone[-1].mtu_fix='1'
-add_list firewall.@zone[-1].network='vpn_tunnel'
-
 # --- Forwarding: lan → wan (internet for owner) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='lan'
 set firewall.@forwarding[-1].dest='wan'
 
-# --- Forwarding: guest → vpn_tunnel ONLY (kill switch: no wan!) ---
+# --- Zone: vps_gateway (default VPN exit for guests, activated by heartbeat) ---
+add firewall zone
+set firewall.@zone[-1].name='vps_gateway'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='vps_gateway'
+
+# --- Forwarding: guest → vps_gateway (active once heartbeat enables interface) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='guest'
-set firewall.@forwarding[-1].dest='vpn_tunnel'
+set firewall.@forwarding[-1].dest='vps_gateway'
 
 # --- Rule: guest DHCP (allow guests to get IP) ---
 add firewall rule
@@ -304,14 +517,13 @@ set firewall.@rule[-1].dest_port='67'
 set firewall.@rule[-1].target='ACCEPT'
 set firewall.@rule[-1].family='ipv4'
 
-# --- Rule: guest DNS to router only (hijacked to DoH) ---
+# --- Rule: guest DNS to router (hijacked to DoH, dual-stack) ---
 add firewall rule
 set firewall.@rule[-1].name='Guest DNS'
 set firewall.@rule[-1].src='guest'
 set firewall.@rule[-1].proto='tcpudp'
 set firewall.@rule[-1].dest_port='53'
 set firewall.@rule[-1].target='ACCEPT'
-set firewall.@rule[-1].family='ipv4'
 
 # --- Rule: block guest → lan (isolation) ---
 add firewall rule
@@ -321,10 +533,20 @@ set firewall.@rule[-1].dest='lan'
 set firewall.@rule[-1].proto='all'
 set firewall.@rule[-1].target='REJECT'
 
-# --- Rule: block ALL IPv6 from guest (leak prevention) ---
+# --- Rule: allow guest DHCPv6/RA (IPv6 address assignment) ---
 add firewall rule
-set firewall.@rule[-1].name='Block guest IPv6'
+set firewall.@rule[-1].name='Guest RA'
 set firewall.@rule[-1].src='guest'
+set firewall.@rule[-1].proto='icmp'
+set firewall.@rule[-1].family='ipv6'
+set firewall.@rule[-1].icmp_type='router-solicitation'
+set firewall.@rule[-1].target='ACCEPT'
+
+# --- Rule: block guest IPv6 to WAN (only Yggdrasil allowed via forwarding) ---
+add firewall rule
+set firewall.@rule[-1].name='Block guest IPv6 WAN'
+set firewall.@rule[-1].src='guest'
+set firewall.@rule[-1].dest='wan'
 set firewall.@rule[-1].proto='all'
 set firewall.@rule[-1].family='ipv6'
 set firewall.@rule[-1].target='REJECT'
@@ -356,6 +578,8 @@ set firewall.@rule[-1].proto='icmp'
 set firewall.@rule[-1].icmp_type='echo-request'
 set firewall.@rule[-1].target='ACCEPT'
 FW_EOF
+fi
+
 uci commit firewall
 
 # ============================================================================
@@ -366,7 +590,18 @@ uci commit firewall
 uci -q delete dhcp.lan 2>/dev/null || true
 uci -q delete dhcp.guest 2>/dev/null || true
 
-uci batch <<-DHCP_EOF
+if [ "$ROLE" = "bee" ]; then
+    # Bee: private DHCP only (no guest pool)
+    uci batch <<-DHCP_EOF
+set dhcp.private=dhcp
+set dhcp.private.interface='private'
+set dhcp.private.start='100'
+set dhcp.private.limit='150'
+set dhcp.private.leasetime='12h'
+DHCP_EOF
+else
+    # Bumblebee: private + guest DHCP
+    uci batch <<-DHCP_EOF
 # --- Private DHCP ---
 set dhcp.private=dhcp
 set dhcp.private.interface='private'
@@ -381,35 +616,39 @@ set dhcp.guest.start='100'
 set dhcp.guest.limit='50'
 set dhcp.guest.leasetime='1h'
 DHCP_EOF
+fi
+
 uci commit dhcp
 
 # ============================================================================
-# 8. SQM TRAFFIC SHAPING (guest 512 kbps limit)
+# 8. SPEED CONTROL (Bumblebee only — per-client shaping, paid Lightning upgrade)
 # ============================================================================
 
-# Find the guest interface device name (will be set after network restart)
-# SQM watches the interface name from the network config
+if [ "$ROLE" != "bee" ]; then
+    chmod +x /usr/bin/parahub-speed-control
 
-uci batch <<-SQM_EOF
-set sqm.guest=queue
-set sqm.guest.enabled='1'
-set sqm.guest.interface='br-guest'
-set sqm.guest.download='512'
-set sqm.guest.upload='512'
-set sqm.guest.qdisc='cake'
-set sqm.guest.script='piece_of_cake.qos'
-set sqm.guest.linklayer='ethernet'
-set sqm.guest.overhead='44'
-SQM_EOF
-uci commit sqm
+    # Create init.d service for speed control
+    cat > /etc/init.d/parahub-speed <<'INITEOF'
+#!/bin/sh /etc/rc.common
+START=99
+start() { /usr/bin/parahub-speed-control init; }
+stop() {
+    tc qdisc del dev br-guest root 2>/dev/null
+    tc qdisc del dev br-guest ingress 2>/dev/null
+    ip link del ifb-guest 2>/dev/null
+    nft delete table inet parahub 2>/dev/null
+}
+INITEOF
+    chmod +x /etc/init.d/parahub-speed
+    /etc/init.d/parahub-speed enable
+fi
 
 # ============================================================================
-# 9. DNS-OVER-HTTPS (guest DNS privacy)
+# 9. DNS-OVER-HTTPS (Bumblebee only — guest DNS privacy)
 # ============================================================================
 
-# https-dns-proxy: local DoH resolver for guest DNS queries
-# Guest DNS is hijacked via firewall redirect to this resolver
-uci batch <<-DOH_EOF
+if [ "$ROLE" != "bee" ]; then
+    uci batch <<-DOH_EOF
 set https-dns-proxy.main=main
 set https-dns-proxy.main.doh_paramters='-4'
 set https-dns-proxy.main.listen_addr='0.0.0.0'
@@ -420,16 +659,17 @@ set https-dns-proxy.cloudflare.resolver_url='https://1.1.1.1/dns-query'
 set https-dns-proxy.cloudflare.listen_addr='127.0.0.1'
 set https-dns-proxy.cloudflare.listen_port='5053'
 DOH_EOF
-uci commit https-dns-proxy
+    uci commit https-dns-proxy
 
-# Configure dnsmasq to use DoH for upstream
-uci -q delete dhcp.@dnsmasq[0].server 2>/dev/null || true
-uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5053'
-uci set dhcp.@dnsmasq[0].noresolv='1'
-uci commit dhcp
+    # Configure dnsmasq to use DoH for upstream
+    uci -q delete dhcp.@dnsmasq[0].server 2>/dev/null || true
+    uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5053'
+    uci set dhcp.@dnsmasq[0].noresolv='1'
+    uci commit dhcp
 
-# Enable https-dns-proxy service
-/etc/init.d/https-dns-proxy enable 2>/dev/null || true
+    # Enable https-dns-proxy service
+    /etc/init.d/https-dns-proxy enable 2>/dev/null || true
+fi
 
 # ============================================================================
 # 10. SYSTEM SETTINGS
@@ -446,46 +686,150 @@ SYS_EOF
 uci commit system
 
 # ============================================================================
-# 11. YGGDRASIL OVERLAY NETWORK
+# 11. YGGDRASIL OVERLAY NETWORK (Bumblebee only)
 # ============================================================================
 
-# Generate unique keys for this node
-yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
+if [ "$ROLE" != "bee" ]; then
+    # Generate unique keys for this node
+    yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
 
-# Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
-sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
+    # Add VPS as static Yggdrasil peer (management plane: remote access, heartbeat)
+    sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
 
-# UCI network interface for yggdrasil TUN
-uci batch <<-YGG_EOF
+    # UCI network interface for yggdrasil TUN
+    uci batch <<-YGG_EOF
 set network.yggdrasil=interface
 set network.yggdrasil.device='ygg0'
 set network.yggdrasil.proto='none'
 YGG_EOF
-uci commit network
+    uci commit network
 
-# Add yggdrasil to LAN zone (mesh nodes trust each other)
-uci add_list firewall.@zone[0].network='yggdrasil'
-uci commit firewall
+    # Yggdrasil firewall zone (separate from LAN — allows guest→yggdrasil forwarding)
+    uci batch <<-YGG_FW_EOF
+add firewall zone
+set firewall.@zone[-1].name='yggdrasil'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+add_list firewall.@zone[-1].network='yggdrasil'
 
-# Enable yggdrasil service
-/etc/init.d/yggdrasil enable
+# Allow SSH on Yggdrasil (remote management)
+add firewall rule
+set firewall.@rule[-1].name='Allow SSH Ygg'
+set firewall.@rule[-1].src='yggdrasil'
+set firewall.@rule[-1].proto='tcp'
+set firewall.@rule[-1].dest_port='22'
+set firewall.@rule[-1].target='ACCEPT'
 
-# Save yggdrasil address to node keys file
-YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
-echo "YGGDRASIL_ADDRESS=${YGG_ADDR}" >> /etc/parahub/keys
+# Allow HTTP on Yggdrasil (LuCI)
+add firewall rule
+set firewall.@rule[-1].name='Allow HTTP Ygg'
+set firewall.@rule[-1].src='yggdrasil'
+set firewall.@rule[-1].proto='tcp'
+set firewall.@rule[-1].dest_port='80'
+set firewall.@rule[-1].target='ACCEPT'
+
+# Allow ICMPv6 on Yggdrasil
+add firewall rule
+set firewall.@rule[-1].name='Allow ICMPv6 Ygg'
+set firewall.@rule[-1].src='yggdrasil'
+set firewall.@rule[-1].proto='icmp'
+set firewall.@rule[-1].family='ipv6'
+set firewall.@rule[-1].target='ACCEPT'
+
+# Forwardings: LAN ↔ Yggdrasil (owner full access)
+add firewall forwarding
+set firewall.@forwarding[-1].src='lan'
+set firewall.@forwarding[-1].dest='yggdrasil'
+
+add firewall forwarding
+set firewall.@forwarding[-1].src='yggdrasil'
+set firewall.@forwarding[-1].dest='lan'
+
+# Forwarding: guest → yggdrasil (IPv6 Parahub services at full speed)
+add firewall forwarding
+set firewall.@forwarding[-1].src='guest'
+set firewall.@forwarding[-1].dest='yggdrasil'
+YGG_FW_EOF
+    uci commit firewall
+
+    # Enable yggdrasil service
+    /etc/init.d/yggdrasil enable 2>/dev/null || true
+
+    # Save yggdrasil address to node keys file
+    YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
+    echo "YGGDRASIL_ADDRESS=${YGG_ADDR}" >> /etc/parahub/keys
+else
+    YGG_ADDR="none"
+fi
 
 # ============================================================================
-# 12. FINAL
+# 12. GUEST IPv6 VIA YGGDRASIL (Bumblebee only — full-speed Parahub access)
+# ============================================================================
+
+if [ "$ROLE" != "bee" ]; then
+    # Extract Yggdrasil 300::/64 subnet for guest SLAAC
+    YGG_SUBNET=$(yggdrasil -subnet -useconffile /etc/yggdrasil.conf 2>/dev/null)
+    # YGG_SUBNET format: 300:xxxx:xxxx:xxxx::/64
+    YGG_SUBNET_PREFIX="${YGG_SUBNET%%::*}"  # 300:xxxx:xxxx:xxxx
+
+    if [ -n "$YGG_SUBNET_PREFIX" ]; then
+        # Assign IPv6 from Yggdrasil subnet to guest interface
+        uci set network.guest.ip6addr="${YGG_SUBNET_PREFIX}::1/64"
+        uci commit network
+
+        # Configure RA/SLAAC for guest (odhcpd)
+        uci batch <<-GUEST6_EOF
+set dhcp.guest.ra='server'
+set dhcp.guest.dhcpv6='disabled'
+set dhcp.guest.ra_management='0'
+set dhcp.guest.ra_default='1'
+set dhcp.guest.ra_slaac='1'
+GUEST6_EOF
+        uci commit dhcp
+
+        logger -t parahub-mesh "Guest IPv6: ${YGG_SUBNET_PREFIX}::1/64 (SLAAC)"
+    else
+        logger -t parahub-mesh "Warning: Could not extract Yggdrasil subnet, guest IPv6 disabled"
+    fi
+fi
+
+# ============================================================================
+# 13. HEARTBEAT (phone-home to Parahub cloud)
+# ============================================================================
+
+chmod +x /usr/bin/parahub-heartbeat
+chmod +x /usr/bin/parahub-autoupdate
+chmod +x /usr/bin/parahub-gw-check
+chmod +x /usr/bin/parahub-vps-setup
+
+# Cron: heartbeat every 5 min, gateway health check every 2 min, OTA nightly
+echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
+echo "*/2 * * * * /usr/bin/parahub-gw-check" >> /etc/crontabs/root
+echo "0 3 * * * /usr/bin/parahub-autoupdate" >> /etc/crontabs/root
+/etc/init.d/cron enable
+
+# ============================================================================
+# 14. FINAL
 # ============================================================================
 
 # Log completion
-logger -t parahub-mesh "First boot configuration complete"
+logger -t parahub-mesh "First boot configuration complete (role: ${ROLE})"
 logger -t parahub-mesh "Hostname: ${HOSTNAME}"
+logger -t parahub-mesh "Role: ${ROLE}"
 logger -t parahub-mesh "Private: ${PRIVATE_SSID} @ ${PRIV_IP}/24"
-logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
-logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
-logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
-logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
-logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
+
+if [ "$ROLE" = "bee" ]; then
+    logger -t parahub-mesh "parahub.io/free: bridged to private (no guest isolation)"
+    logger -t parahub-mesh "bat0 gw_mode: client (uses Bumblebee as gateway)"
+else
+    logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
+    logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
+    logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
+    logger -t parahub-mesh "Guest internet: VPS gateway (auto-configured via heartbeat)"
+    logger -t parahub-mesh "Optional: parahub-mullvad setup for lower latency"
+    logger -t parahub-mesh "Guest IPv6: Yggdrasil SLAAC (full speed, firewall restricted)"
+    logger -t parahub-mesh "bat0 gw_mode: client (promoted to server by gw-check when WireGuard active)"
+fi
 
 exit 0

files/usr/bin/parahub-autoupdate

@@ -0,0 +1,97 @@
+#!/bin/sh
+# Parahub Mesh — OTA Auto-Update
+# Checks manifest.json for new firmware, downloads and verifies, runs sysupgrade.
+# Runs nightly via cron. Lock file prevents concurrent runs.
+
+LOCK="/tmp/parahub-autoupdate.lock"
+MANIFEST_YGG="http://[200:abb9:5810:37d3:8a4c:98a6:b82b:969a]/firmware/manifest.json"
+MANIFEST_PUBLIC="https://parahub.io/firmware/manifest.json"
+FIRMWARE_YGG="http://[200:abb9:5810:37d3:8a4c:98a6:b82b:969a]/firmware"
+FIRMWARE_PUBLIC="https://parahub.io/firmware"
+
+# Lock — exit if already running
+if [ -f "$LOCK" ]; then
+    LOCK_PID=$(cat "$LOCK" 2>/dev/null)
+    if kill -0 "$LOCK_PID" 2>/dev/null; then
+        logger -t parahub-update "Already running (pid $LOCK_PID), exiting"
+        exit 0
+    fi
+    rm -f "$LOCK"
+fi
+echo $$ > "$LOCK"
+trap 'rm -f "$LOCK"' EXIT
+
+# Read current version and device profile
+CURRENT_VERSION=$(cat /etc/parahub/version 2>/dev/null)
+DEVICE_PROFILE=$(cat /etc/parahub/profile 2>/dev/null)
+ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "unknown")
+
+if [ -z "$CURRENT_VERSION" ] || [ -z "$DEVICE_PROFILE" ]; then
+    logger -t parahub-update "Missing /etc/parahub/version or /etc/parahub/profile, skipping"
+    exit 1
+fi
+
+# Fetch manifest (Yggdrasil first for bumblebee, public for bee)
+MANIFEST=""
+if [ "$ROLE" != "bee" ] && ping6 -c 1 -W 3 200:abb9:5810:37d3:8a4c:98a6:b82b:969a >/dev/null 2>&1; then
+    MANIFEST=$(curl -s -m 30 "$MANIFEST_YGG" 2>/dev/null)
+    BASE_URL="$FIRMWARE_YGG"
+fi
+
+if [ -z "$MANIFEST" ]; then
+    MANIFEST=$(curl -s -m 30 "$MANIFEST_PUBLIC" 2>/dev/null)
+    BASE_URL="$FIRMWARE_PUBLIC"
+fi
+
+if [ -z "$MANIFEST" ]; then
+    logger -t parahub-update "Failed to fetch manifest"
+    exit 1
+fi
+
+# Parse manifest with jsonfilter
+NEW_VERSION=$(echo "$MANIFEST" | jsonfilter -e '$.version' 2>/dev/null)
+SYSUPGRADE_FILE=$(echo "$MANIFEST" | jsonfilter -e "$.devices.${DEVICE_PROFILE}.sysupgrade" 2>/dev/null)
+EXPECTED_SHA256=$(echo "$MANIFEST" | jsonfilter -e "$.devices.${DEVICE_PROFILE}.sha256" 2>/dev/null)
+
+if [ -z "$NEW_VERSION" ]; then
+    logger -t parahub-update "Could not parse version from manifest"
+    exit 1
+fi
+
+if [ -z "$SYSUPGRADE_FILE" ] || [ -z "$EXPECTED_SHA256" ]; then
+    logger -t parahub-update "Device ${DEVICE_PROFILE} not found in manifest"
+    exit 0
+fi
+
+# Compare versions
+if [ "$CURRENT_VERSION" = "$NEW_VERSION" ]; then
+    logger -t parahub-update "Already up to date: ${CURRENT_VERSION}"
+    exit 0
+fi
+
+logger -t parahub-update "Update available: ${CURRENT_VERSION} → ${NEW_VERSION}"
+
+# Download firmware
+FIRMWARE_PATH="/tmp/firmware.bin"
+rm -f "$FIRMWARE_PATH"
+
+curl -s -m 600 -o "$FIRMWARE_PATH" "${BASE_URL}/${SYSUPGRADE_FILE}" 2>/dev/null
+
+if [ ! -f "$FIRMWARE_PATH" ]; then
+    logger -t parahub-update "Download failed: ${SYSUPGRADE_FILE}"
+    exit 1
+fi
+
+# Verify SHA256
+ACTUAL_SHA256=$(sha256sum "$FIRMWARE_PATH" | cut -d' ' -f1)
+
+if [ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]; then
+    logger -t parahub-update "SHA256 mismatch! Expected: ${EXPECTED_SHA256}, Got: ${ACTUAL_SHA256}"
+    rm -f "$FIRMWARE_PATH"
+    exit 1
+fi
+
+logger -t parahub-update "SHA256 verified, starting sysupgrade to ${NEW_VERSION}..."
+
+# Run sysupgrade (preserves /etc/config/ by default + /etc/sysupgrade.conf entries)
+sysupgrade "$FIRMWARE_PATH"

files/usr/bin/parahub-gw-check

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Parahub Gateway Health Check
+# Monitors WireGuard status (VPS gateway or Mullvad) and switches batman-adv gw_mode:
+#   - WireGuard active (recent handshake) → gw_mode=server (advertise as gateway)
+#   - WireGuard down or not configured    → gw_mode=client (relay only)
+#
+# Run via cron every 2 minutes. Bumblebee only.
+
+[ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || exit 0
+
+# Check if any WireGuard interface has a recent handshake
+WG_OK=0
+if command -v wg >/dev/null 2>&1; then
+    # Get latest handshake timestamp from any WireGuard interface
+    LAST_HS=$(wg show all latest-handshakes 2>/dev/null | awk '{print $NF}' | sort -rn | head -1)
+    if [ -n "$LAST_HS" ] && [ "$LAST_HS" -gt 0 ] 2>/dev/null; then
+        NOW=$(date +%s)
+        AGE=$((NOW - LAST_HS))
+        # Handshake within last 5 minutes = alive
+        [ "$AGE" -lt 300 ] && WG_OK=1
+    fi
+fi
+
+CURRENT_MODE=$(batctl gw_mode 2>/dev/null | awk '{print $1}')
+
+if [ "$WG_OK" = "1" ]; then
+    if [ "$CURRENT_MODE" != "server" ]; then
+        batctl gw_mode server
+        logger -t parahub-gw "WireGuard active, switched to gw_mode=server"
+    fi
+else
+    if [ "$CURRENT_MODE" != "client" ]; then
+        batctl gw_mode client
+        logger -t parahub-gw "WireGuard down, switched to gw_mode=client"
+    fi
+fi

files/usr/bin/parahub-heartbeat

@@ -0,0 +1,98 @@
+#!/bin/sh
+# Phone-home heartbeat to Parahub cloud
+PARAHUB_API_YGG="http://[200:abb9:5810:37d3:8a4c:98a6:b82b:969a]/api/v1/iot/mesh/heartbeat"
+PARAHUB_API_PUBLIC="https://parahub.io/api/v1/iot/mesh/heartbeat"
+HEARTBEAT_KEY="IqPosrcpTQKSbLHxOG3iLTl_K2MsDxvd"
+
+# Read firmware role
+ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "unknown")
+
+# Read identity from /etc/parahub/keys
+. /etc/parahub/keys 2>/dev/null
+MAC="${NODE_MAC:-$(cat /sys/class/net/br-lan/address 2>/dev/null)}"
+HOSTNAME="$(uci -q get system.@system[0].hostname)"
+YGG_ADDR="${YGGDRASIL_ADDRESS:-unknown}"
+SSID="${PRIVATE_SSID:-unknown}"
+UPTIME="$(cut -d. -f1 /proc/uptime)"
+
+# Get mesh IP (br-private address)
+MESH_IP=$(ip -4 addr show br-private 2>/dev/null | grep -o 'inet [0-9.]*' | cut -d' ' -f2)
+MESH_IP="${MESH_IP:-unknown}"
+
+# Generate WireGuard VPS keypair if missing (OTA from pre-VPS firmware)
+if [ "$ROLE" != "bee" ] && [ ! -f /etc/parahub/wg_vps_private.key ] && command -v wg >/dev/null 2>&1; then
+    umask 077
+    wg genkey > /etc/parahub/wg_vps_private.key
+    wg pubkey < /etc/parahub/wg_vps_private.key > /etc/parahub/wg_vps_public.key
+    logger -t parahub-heartbeat "Generated VPS WireGuard keypair (OTA migration)"
+fi
+
+# Read WireGuard VPS public key (Bumblebee only)
+WG_PUBKEY=""
+if [ -f /etc/parahub/wg_vps_public.key ]; then
+    WG_PUBKEY=$(cat /etc/parahub/wg_vps_public.key 2>/dev/null)
+fi
+
+# Detect hardware from board_name
+HW=$(cat /tmp/sysinfo/board_name 2>/dev/null)
+case "$HW" in
+    glinet,gl-axt1800) HW="axt1800" ;;
+    glinet,gl-mt3000) HW="mt3000" ;;
+    glinet,gl-mt6000) HW="mt6000" ;;
+    xiaomi,redmi-router-ax6s) HW="ax6s" ;;
+    asus,rt-ax53u) HW="ax53u" ;;
+    glinet,gl-ar300m16) HW="ar300m16" ;;
+    cudy,wr3000-v1) HW="wr3000" ;;
+    *) HW="${HW:-unknown}" ;;
+esac
+
+FW_VERSION=$(cat /etc/parahub/version 2>/dev/null || echo "unknown")
+PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"${FW_VERSION}\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\",\"wg_public_key\":\"${WG_PUBKEY}\"}"
+
+RESPONSE=""
+
+if [ "$ROLE" = "bee" ]; then
+    # Bee: no yggdrasil, use public URL only
+    RESPONSE=$(curl -s -m 10 -X POST \
+        -H "Content-Type: application/json" \
+        -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
+        -d "$PAYLOAD" \
+        "${PARAHUB_API_PUBLIC}" 2>/dev/null)
+else
+    # Bumblebee: try yggdrasil first, fallback to public
+    if ping6 -c 1 -W 3 200:abb9:5810:37d3:8a4c:98a6:b82b:969a >/dev/null 2>&1; then
+        RESPONSE=$(curl -s -m 10 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
+            -d "$PAYLOAD" \
+            "${PARAHUB_API_YGG}" 2>/dev/null)
+    else
+        RESPONSE=$(curl -s -m 10 -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: Bearer ${HEARTBEAT_KEY}" \
+            -d "$PAYLOAD" \
+            "${PARAHUB_API_PUBLIC}" 2>/dev/null)
+    fi
+fi
+
+# Sync paid_clients to speed control (Bumblebee only)
+if [ "$ROLE" != "bee" ] && [ -x /usr/bin/parahub-speed-control ] && [ -n "$RESPONSE" ]; then
+    PAID_IPS=$(echo "$RESPONSE" | jsonfilter -e '$.paid_clients[*]' 2>/dev/null)
+    # Flush and re-add all paid IPs
+    parahub-speed-control flush
+    for IP in $PAID_IPS; do
+        parahub-speed-control add "$IP"
+    done
+fi
+
+# VPS gateway auto-configuration (Bumblebee only, skip if Mullvad is configured)
+if [ "$ROLE" != "bee" ] && [ -n "$RESPONSE" ] && [ ! -f /etc/parahub/mullvad_account ]; then
+    VPS_ENDPOINT=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.endpoint' 2>/dev/null)
+    VPS_PUBKEY=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.public_key' 2>/dev/null)
+    VPS_IP=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.assigned_ip' 2>/dev/null)
+    VPS_KEEPALIVE=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.keepalive' 2>/dev/null)
+
+    if [ -n "$VPS_ENDPOINT" ] && [ -n "$VPS_PUBKEY" ] && [ -n "$VPS_IP" ]; then
+        /usr/bin/parahub-vps-setup "$VPS_ENDPOINT" "$VPS_PUBKEY" "$VPS_IP" "${VPS_KEEPALIVE:-25}"
+    fi
+fi

files/usr/bin/parahub-mullvad

@@ -0,0 +1,301 @@
+#!/bin/sh
+# Parahub Mesh — Local Mullvad WireGuard Manager
+#
+# Allows the node owner to run Mullvad directly on the router.
+# Guest traffic routes through the local WireGuard tunnel instead of
+# the default VPS gateway path, giving lower latency and using the
+# nearest Mullvad server.
+#
+# Usage:
+#   parahub-mullvad setup <account_key> [country_code]
+#   parahub-mullvad status
+#   parahub-mullvad remove
+
+set -e
+
+PARAHUB_DIR="/etc/parahub"
+ACCOUNT_FILE="$PARAHUB_DIR/mullvad_account"
+
+# ============================================================================
+# Helpers
+# ============================================================================
+
+# Find the firewall forwarding index where src=guest
+find_guest_forwarding() {
+    local idx=0
+    while uci -q get "firewall.@forwarding[$idx]" >/dev/null 2>&1; do
+        local src=$(uci -q get "firewall.@forwarding[$idx].src")
+        if [ "$src" = "guest" ]; then
+            echo "$idx"
+            return 0
+        fi
+        idx=$((idx + 1))
+    done
+    return 1
+}
+
+# Find firewall zone index by name
+find_zone_index() {
+    local name="$1"
+    local idx=0
+    while uci -q get "firewall.@zone[$idx]" >/dev/null 2>&1; do
+        local zname=$(uci -q get "firewall.@zone[$idx].name")
+        if [ "$zname" = "$name" ]; then
+            echo "$idx"
+            return 0
+        fi
+        idx=$((idx + 1))
+    done
+    return 1
+}
+
+# ============================================================================
+# setup <account_key> [country_code]
+# ============================================================================
+
+cmd_setup() {
+    local ACCOUNT="$1"
+    local COUNTRY="$2"
+
+    if [ -z "$ACCOUNT" ]; then
+        echo "Usage: parahub-mullvad setup <account_key> [country_code]"
+        echo ""
+        echo "Examples:"
+        echo "  parahub-mullvad setup 1234567890123456 pt   # Portugal"
+        echo "  parahub-mullvad setup 1234567890123456 de   # Germany"
+        echo "  parahub-mullvad setup 1234567890123456       # Auto-detect"
+        echo ""
+        echo "Countries: us gb de nl se pt fr es ch at it jp sg br ..."
+        exit 1
+    fi
+
+    # Auto-detect country from WAN IP
+    if [ -z "$COUNTRY" ]; then
+        echo "Auto-detecting country from WAN IP..."
+        COUNTRY=$(curl -s --max-time 5 https://ipinfo.io/country 2>/dev/null | tr 'A-Z' 'a-z')
+        if [ -z "$COUNTRY" ] || [ ${#COUNTRY} -ne 2 ]; then
+            echo "Error: Could not detect country."
+            echo "Specify manually: parahub-mullvad setup $ACCOUNT <country>"
+            exit 1
+        fi
+        echo "Detected: $COUNTRY"
+    fi
+
+    COUNTRY=$(echo "$COUNTRY" | tr 'A-Z' 'a-z')
+
+    # --- Step 1: Generate WireGuard keys ---
+    echo "Generating WireGuard keys..."
+    umask 077
+    wg genkey > "$PARAHUB_DIR/wg_private.key"
+    wg pubkey < "$PARAHUB_DIR/wg_private.key" > "$PARAHUB_DIR/wg_public.key"
+
+    PRIVKEY=$(cat "$PARAHUB_DIR/wg_private.key")
+    PUBKEY=$(cat "$PARAHUB_DIR/wg_public.key")
+
+    # --- Step 2: Register with Mullvad API ---
+    echo "Registering key with Mullvad..."
+    RESULT=$(curl -s --max-time 15 -X POST https://api.mullvad.net/wg/ \
+        --data-urlencode "account=$ACCOUNT" \
+        --data-urlencode "pubkey=$PUBKEY")
+
+    if echo "$RESULT" | grep -q "^[0-9]"; then
+        MULLVAD_IPV4=$(echo "$RESULT" | cut -d',' -f1)
+        echo "Mullvad IP: $MULLVAD_IPV4"
+    else
+        echo "Error from Mullvad: $RESULT"
+        exit 1
+    fi
+
+    # --- Step 3: Find server in target country ---
+    echo "Finding Mullvad server in '$COUNTRY'..."
+    curl -s --max-time 15 https://api.mullvad.net/www/relays/wireguard/ | \
+        tr '{' '\n' | \
+        grep "\"country_code\":\"${COUNTRY}\"" | \
+        grep '"active":true' | \
+        head -1 > /tmp/mullvad_relay.tmp
+
+    if [ ! -s /tmp/mullvad_relay.tmp ]; then
+        echo "Error: No active WireGuard server for country '$COUNTRY'"
+        rm -f /tmp/mullvad_relay.tmp
+        exit 1
+    fi
+
+    SERVER_IP=$(sed 's/.*"ipv4_addr_in":"\([^"]*\)".*/\1/' /tmp/mullvad_relay.tmp)
+    SERVER_PUBKEY=$(sed 's/.*"pubkey":"\([^"]*\)".*/\1/' /tmp/mullvad_relay.tmp)
+    SERVER_HOST=$(sed 's/.*"hostname":"\([^"]*\)".*/\1/' /tmp/mullvad_relay.tmp)
+    rm -f /tmp/mullvad_relay.tmp
+
+    echo "Server: $SERVER_HOST ($SERVER_IP)"
+
+    # --- Step 4: Clean previous config ---
+    uci -q delete network.mullvad_local 2>/dev/null || true
+    while uci -q delete network.@wireguard_mullvad_local[0] 2>/dev/null; do :; done
+
+    # --- Step 5: Create WireGuard interface (routes in table 100) ---
+    echo "Configuring WireGuard..."
+    uci batch <<-WG_EOF
+set network.mullvad_local=interface
+set network.mullvad_local.proto='wireguard'
+set network.mullvad_local.private_key='${PRIVKEY}'
+add_list network.mullvad_local.addresses='${MULLVAD_IPV4}'
+set network.mullvad_local.mtu='1420'
+set network.mullvad_local.ip4table='100'
+
+add network wireguard_mullvad_local
+set network.@wireguard_mullvad_local[-1].public_key='${SERVER_PUBKEY}'
+set network.@wireguard_mullvad_local[-1].endpoint_host='${SERVER_IP}'
+set network.@wireguard_mullvad_local[-1].endpoint_port='51820'
+add_list network.@wireguard_mullvad_local[-1].allowed_ips='0.0.0.0/0'
+set network.@wireguard_mullvad_local[-1].route_allowed_ips='1'
+set network.@wireguard_mullvad_local[-1].persistent_keepalive='25'
+WG_EOF
+
+    # Disable VPS gateway (Mullvad replaces it in table 100)
+    uci -q set network.vps_gateway.auto='0' 2>/dev/null || true
+    uci commit network
+
+    # --- Step 6: Firewall zone for mullvad_local ---
+    local zone_idx
+    if zone_idx=$(find_zone_index "mullvad_local"); then
+        uci delete "firewall.@zone[$zone_idx]"
+    fi
+
+    uci batch <<-FW_EOF
+add firewall zone
+set firewall.@zone[-1].name='mullvad_local'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='mullvad_local'
+FW_EOF
+
+    # Switch guest forwarding to mullvad_local
+    local fwd_idx
+    if fwd_idx=$(find_guest_forwarding); then
+        uci set "firewall.@forwarding[$fwd_idx].dest=mullvad_local"
+    fi
+    uci commit firewall
+
+    # --- Step 7: Save config ---
+    cat > "$ACCOUNT_FILE" <<-ACCT_EOF
+MULLVAD_ACCOUNT=${ACCOUNT}
+MULLVAD_COUNTRY=${COUNTRY}
+MULLVAD_SERVER=${SERVER_HOST}
+MULLVAD_SERVER_IP=${SERVER_IP}
+MULLVAD_LOCAL_IP=${MULLVAD_IPV4}
+ACCT_EOF
+    chmod 600 "$ACCOUNT_FILE"
+
+    # --- Step 8: Apply ---
+    echo "Restarting network..."
+    /etc/init.d/network restart
+    /etc/init.d/firewall restart
+
+    echo ""
+    echo "Done! Guest traffic now routes directly through Mullvad."
+    echo "Server: $SERVER_HOST ($COUNTRY)"
+    echo "Test: connect to parahub.io/free, visit https://am.i.mullvad.net"
+}
+
+# ============================================================================
+# status
+# ============================================================================
+
+cmd_status() {
+    echo "=== Parahub Mesh VPN Status ==="
+    echo ""
+
+    if [ -f "$ACCOUNT_FILE" ]; then
+        echo "Mode: LOCAL MULLVAD (direct)"
+        cat "$ACCOUNT_FILE"
+        echo ""
+        wg show mullvad_local 2>/dev/null || echo "WireGuard interface: not up"
+    else
+        echo "Mode: VPS GATEWAY (WireGuard)"
+        echo "VPS: 185.47.131.84 -> Mullvad"
+        echo ""
+        wg show vps_gateway 2>/dev/null || echo "VPS gateway: not active"
+    fi
+
+    echo ""
+    echo "Guest forwarding:"
+    local fwd_idx
+    if fwd_idx=$(find_guest_forwarding); then
+        echo "  guest -> $(uci -q get "firewall.@forwarding[$fwd_idx].dest")"
+    else
+        echo "  (none)"
+    fi
+}
+
+# ============================================================================
+# remove
+# ============================================================================
+
+cmd_remove() {
+    if [ ! -f "$ACCOUNT_FILE" ]; then
+        echo "No local Mullvad configured. Nothing to remove."
+        exit 0
+    fi
+
+    echo "Removing local Mullvad, reverting to VPS gateway..."
+
+    # Remove WireGuard interface
+    uci -q delete network.mullvad_local 2>/dev/null || true
+    while uci -q delete network.@wireguard_mullvad_local[0] 2>/dev/null; do :; done
+
+    # Re-enable VPS gateway
+    uci -q delete network.vps_gateway.auto 2>/dev/null || true
+    uci commit network
+
+    # Remove firewall zone
+    local zone_idx
+    if zone_idx=$(find_zone_index "mullvad_local"); then
+        uci delete "firewall.@zone[$zone_idx]"
+    fi
+
+    # Switch guest forwarding back to vps_gateway
+    local fwd_idx
+    if fwd_idx=$(find_guest_forwarding); then
+        uci set "firewall.@forwarding[$fwd_idx].dest=vps_gateway"
+    fi
+    uci commit firewall
+
+    # Clean up files
+    rm -f "$PARAHUB_DIR/wg_private.key" "$PARAHUB_DIR/wg_public.key" "$ACCOUNT_FILE"
+
+    echo "Restarting network..."
+    /etc/init.d/network restart
+    /etc/init.d/firewall restart
+
+    echo "Done! Guest traffic now routes through VPS gateway."
+}
+
+# ============================================================================
+# Main
+# ============================================================================
+
+case "${1:-}" in
+    setup)
+        cmd_setup "$2" "${3:-}"
+        ;;
+    status)
+        cmd_status
+        ;;
+    remove)
+        cmd_remove
+        ;;
+    *)
+        echo "Parahub Mesh — Mullvad WireGuard Manager"
+        echo ""
+        echo "Commands:"
+        echo "  parahub-mullvad setup <account_key> [country]"
+        echo "  parahub-mullvad status"
+        echo "  parahub-mullvad remove"
+        echo ""
+        echo "By default, guest traffic goes through the VPS gateway."
+        echo "With 'setup', it routes directly through your own Mullvad"
+        echo "account — faster, and uses the nearest server."
+        ;;
+esac

files/usr/bin/parahub-speed-control

@@ -0,0 +1,81 @@
+#!/bin/sh
+# Parahub Mesh — Per-client speed control
+# Free tier: 512kbps (default), Paid tier: full speed (via nftables set + tc HTB)
+#
+# Usage: parahub-speed-control init|add <ip>|remove <ip>|list|flush
+
+IFACE="br-guest"
+SLOW_RATE="512kbit"
+
+case "$1" in
+  init)
+    # Remove SQM if active
+    /etc/init.d/sqm stop 2>/dev/null
+    /etc/init.d/sqm disable 2>/dev/null
+
+    # --- Egress shaping (router → client, i.e. download for client) ---
+    tc qdisc del dev $IFACE root 2>/dev/null
+    tc qdisc add dev $IFACE root handle 1: htb default 10
+    tc class add dev $IFACE parent 1: classid 1:1 htb rate 1000mbit
+    tc class add dev $IFACE parent 1:1 classid 1:10 htb rate $SLOW_RATE ceil $SLOW_RATE  # free tier
+    tc class add dev $IFACE parent 1:1 classid 1:20 htb rate 1000mbit                     # paid tier
+    tc qdisc add dev $IFACE parent 1:10 fq_codel
+    tc qdisc add dev $IFACE parent 1:20 fq_codel
+
+    # tc filter: packets with mark 0x20 → paid class
+    tc filter add dev $IFACE parent 1: protocol ip handle 0x20 fw flowid 1:20
+
+    # Exempt ALL IPv6 from shaping — only Yggdrasil IPv6 reaches guests (firewall enforced)
+    tc filter add dev $IFACE parent 1: protocol ipv6 prio 1 u32 match u32 0 0 flowid 1:20
+
+    # --- Ingress shaping (client → router, i.e. upload for client) via IFB ---
+    ip link add ifb-guest type ifb 2>/dev/null
+    ip link set ifb-guest up
+    tc qdisc del dev $IFACE ingress 2>/dev/null
+    tc qdisc add dev $IFACE ingress
+    tc filter add dev $IFACE parent ffff: protocol ip u32 match u32 0 0 action mirred egress redirect dev ifb-guest
+    tc filter add dev $IFACE parent ffff: protocol ipv6 u32 match u32 0 0 action mirred egress redirect dev ifb-guest
+
+    tc qdisc del dev ifb-guest root 2>/dev/null
+    tc qdisc add dev ifb-guest root handle 1: htb default 10
+    tc class add dev ifb-guest parent 1: classid 1:1 htb rate 1000mbit
+    tc class add dev ifb-guest parent 1:1 classid 1:10 htb rate $SLOW_RATE ceil $SLOW_RATE
+    tc class add dev ifb-guest parent 1:1 classid 1:20 htb rate 1000mbit
+    tc qdisc add dev ifb-guest parent 1:10 fq_codel
+    tc qdisc add dev ifb-guest parent 1:20 fq_codel
+    tc filter add dev ifb-guest parent 1: protocol ip handle 0x20 fw flowid 1:20
+
+    # Exempt ALL IPv6 from ingress shaping
+    tc filter add dev ifb-guest parent 1: protocol ipv6 prio 1 u32 match u32 0 0 flowid 1:20
+
+    # --- nftables: paid_clients set + mark rules ---
+    nft add table inet parahub 2>/dev/null
+    nft flush table inet parahub 2>/dev/null
+    nft add set inet parahub paid_clients '{ type ipv4_addr; }'
+    nft add chain inet parahub speed_mark '{ type filter hook forward priority -150; }'
+    nft add rule inet parahub speed_mark ip daddr @paid_clients meta mark set 0x20
+    nft add rule inet parahub speed_mark ip saddr @paid_clients meta mark set 0x20
+
+    logger -t parahub-speed "Speed control initialized: free=${SLOW_RATE}, paid=unlimited"
+    ;;
+  add)
+    [ -z "$2" ] && echo "Usage: $0 add <ip>" && exit 1
+    nft add element inet parahub paid_clients "{ $2 }" 2>/dev/null
+    logger -t parahub-speed "Added paid client: $2"
+    ;;
+  remove)
+    [ -z "$2" ] && echo "Usage: $0 remove <ip>" && exit 1
+    nft delete element inet parahub paid_clients "{ $2 }" 2>/dev/null
+    logger -t parahub-speed "Removed paid client: $2"
+    ;;
+  list)
+    nft list set inet parahub paid_clients 2>/dev/null
+    ;;
+  flush)
+    nft flush set inet parahub paid_clients 2>/dev/null
+    ;;
+  *)
+    echo "Usage: $0 {init|add <ip>|remove <ip>|list|flush}"
+    exit 1
+    ;;
+esac

files/usr/bin/parahub-vps-setup

@@ -0,0 +1,126 @@
+#!/bin/sh
+# Parahub Mesh — VPS WireGuard Gateway Setup
+# Called by heartbeat to auto-configure the VPS tunnel for guest internet.
+#
+# Usage: parahub-vps-setup <endpoint> <public_key> <assigned_ip> <keepalive>
+# Example: parahub-vps-setup 185.47.131.84:51820 <base64_key> 10.99.0.2/16 25
+
+ENDPOINT="$1"
+PUBKEY="$2"
+ASSIGNED_IP="$3"
+KEEPALIVE="${4:-25}"
+STATE_FILE="/tmp/vps_gateway_state"
+
+if [ -z "$ENDPOINT" ] || [ -z "$PUBKEY" ] || [ -z "$ASSIGNED_IP" ]; then
+    logger -t parahub-vps "Error: missing arguments"
+    exit 1
+fi
+
+# Check if config unchanged and interface is up — skip reconfiguration
+if [ -f "$STATE_FILE" ]; then
+    OLD_STATE=$(cat "$STATE_FILE")
+    NEW_STATE="${ENDPOINT}|${PUBKEY}|${ASSIGNED_IP}|${KEEPALIVE}"
+    if [ "$OLD_STATE" = "$NEW_STATE" ]; then
+        # Check if interface is actually up
+        if ip link show vps_gateway >/dev/null 2>&1; then
+            exit 0
+        fi
+    fi
+fi
+
+logger -t parahub-vps "Configuring VPS gateway: ${ENDPOINT} -> ${ASSIGNED_IP}"
+
+# Bootstrap: create interface + zone + forwarding if missing (OTA from pre-VPS firmware)
+if ! uci -q get network.vps_gateway >/dev/null 2>&1; then
+    logger -t parahub-vps "Bootstrap: creating vps_gateway interface (OTA upgrade)"
+    uci batch <<-BOOTSTRAP_NET
+set network.vps_gateway=interface
+set network.vps_gateway.proto='wireguard'
+set network.vps_gateway.private_key='$(cat /etc/parahub/wg_vps_private.key)'
+set network.vps_gateway.mtu='1420'
+set network.vps_gateway.ip4table='100'
+BOOTSTRAP_NET
+    uci commit network
+fi
+
+# Bootstrap firewall zone if missing
+ZONE_EXISTS=0
+idx=0
+while uci -q get "firewall.@zone[$idx]" >/dev/null 2>&1; do
+    zname=$(uci -q get "firewall.@zone[$idx].name")
+    if [ "$zname" = "vps_gateway" ]; then
+        ZONE_EXISTS=1
+        break
+    fi
+    idx=$((idx + 1))
+done
+
+if [ "$ZONE_EXISTS" = "0" ]; then
+    logger -t parahub-vps "Bootstrap: creating vps_gateway firewall zone"
+    uci batch <<-BOOTSTRAP_FW
+add firewall zone
+set firewall.@zone[-1].name='vps_gateway'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='vps_gateway'
+BOOTSTRAP_FW
+
+    # Add guest → vps_gateway forwarding if no guest forwarding exists
+    FWD_EXISTS=0
+    fidx=0
+    while uci -q get "firewall.@forwarding[$fidx]" >/dev/null 2>&1; do
+        src=$(uci -q get "firewall.@forwarding[$fidx].src")
+        if [ "$src" = "guest" ]; then
+            FWD_EXISTS=1
+            break
+        fi
+        fidx=$((fidx + 1))
+    done
+
+    if [ "$FWD_EXISTS" = "0" ]; then
+        uci add firewall forwarding >/dev/null
+        uci set "firewall.@forwarding[-1].src=guest"
+        uci set "firewall.@forwarding[-1].dest=vps_gateway"
+    fi
+
+    uci commit firewall
+fi
+
+# Remove old peer sections
+while uci -q delete network.@wireguard_vps_gateway[0] 2>/dev/null; do :; done
+
+# Set address and add peer
+uci -q delete network.vps_gateway.addresses 2>/dev/null || true
+uci add_list network.vps_gateway.addresses="${ASSIGNED_IP}"
+
+# Split endpoint into host:port
+EP_HOST="${ENDPOINT%:*}"
+EP_PORT="${ENDPOINT##*:}"
+
+uci batch <<-PEER_EOF
+add network wireguard_vps_gateway
+set network.@wireguard_vps_gateway[-1].public_key='${PUBKEY}'
+set network.@wireguard_vps_gateway[-1].endpoint_host='${EP_HOST}'
+set network.@wireguard_vps_gateway[-1].endpoint_port='${EP_PORT}'
+add_list network.@wireguard_vps_gateway[-1].allowed_ips='0.0.0.0/0'
+set network.@wireguard_vps_gateway[-1].route_allowed_ips='1'
+set network.@wireguard_vps_gateway[-1].persistent_keepalive='${KEEPALIVE}'
+PEER_EOF
+
+# Enable interface (remove auto='0')
+uci -q delete network.vps_gateway.auto 2>/dev/null || true
+uci commit network
+
+# Bring up the interface (minimal restart)
+ifup vps_gateway 2>/dev/null
+
+# Reload firewall rules
+fw4 reload 2>/dev/null
+
+# Save state for next run
+echo "${ENDPOINT}|${PUBKEY}|${ASSIGNED_IP}|${KEEPALIVE}" > "$STATE_FILE"
+
+logger -t parahub-vps "VPS gateway activated: ${ASSIGNED_IP} via ${ENDPOINT}"

scripts/build.sh

@@ -11,6 +11,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 
 OPENWRT_VERSION="${OPENWRT_VERSION:-25.12.0-rc4}"
+PARAHUB_BUILD="4"
+FIRMWARE_VERSION="${OPENWRT_VERSION}-ph${PARAHUB_BUILD}"
 
 # ============================================================================
 # Device Database (device → target/subtarget + Image Builder profile)
@@ -22,22 +24,44 @@ device_config() {
         axt1800)
             OPENWRT_TARGET="qualcommax/ipq60xx"
             PROFILE="glinet_gl-axt1800"
+            FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="eth0:lan eth1:wan"
             ;;
         mt3000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="glinet_gl-mt3000"
+            FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="eth0:wan eth1:lan"
             ;;
         mt6000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="glinet_gl-mt6000"
-            ;;
-        ax6s)
-            OPENWRT_TARGET="mediatek/filogic"
-            PROFILE="xiaomi_redmi-router-ax6s"
+            FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="eth0:wan eth1:lan"
             ;;
         ax53u)
             OPENWRT_TARGET="ramips/mt7621"
             PROFILE="asus_rt-ax53u"
+            FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="dsa"
+            ;;
+        ar300m16)
+            OPENWRT_TARGET="ath79/generic"
+            PROFILE="glinet_gl-ar300m16"
+            FIRMWARE_ROLE="bee"
+            PORT_MAP="eth0:lan eth1:wan"
+            ;;
+        wr3000)
+            OPENWRT_TARGET="mediatek/filogic"
+            PROFILE="cudy_wr3000-v1"
+            FIRMWARE_ROLE="bee"
+            PORT_MAP="eth0:wan eth1:lan"
+            ;;
+        cpe710)
+            OPENWRT_TARGET="ath79/generic"
+            PROFILE="tplink_cpe710-v1"
+            FIRMWARE_ROLE="bee"
+            PORT_MAP="eth0:lan eth1:wan"
             ;;
         *)
             return 1
@@ -49,37 +73,32 @@ device_config() {
 # Packages
 # ============================================================================
 
-PACKAGES_CORE=(
-    # batman-adv mesh
+# Bee (L2 Transport): minimal mesh relay — no overlay, no guest isolation
+PACKAGES_BEE=(
     kmod-batman-adv
     batctl-full
-
-    # 802.11s mesh support (replace basic wpad, includes OWE)
     wpad-mesh-mbedtls
     -wpad-basic-mbedtls
-
-    # Yggdrasil overlay network
-    yggdrasil
-
-    # GRE6 tunnel (guest traffic → VPS gateway)
-    kmod-gre6
-
-    # DNS-over-HTTPS for guest privacy
-    https-dns-proxy
-
-    # SQM traffic shaping
-    sqm-scripts
-    kmod-sched-cake
-
-    # Management
     luci
-    luci-app-sqm
+    curl
 )
 
-PACKAGES_FULL=(
-    "${PACKAGES_CORE[@]}"
-
-    # Diagnostics
+# Bumblebee (L3 Gateway): full stack — overlay, VPN, guest isolation, diagnostics
+PACKAGES_BUMBLEBEE=(
+    kmod-batman-adv
+    batctl-full
+    wpad-mesh-mbedtls
+    -wpad-basic-mbedtls
+    yggdrasil
+    kmod-gre6
+    kmod-wireguard
+    wireguard-tools
+    luci-proto-wireguard
+    https-dns-proxy
+    tc-full
+    kmod-ifb
+    kmod-sched
+    luci
     tcpdump
     iperf3
     iwinfo
@@ -93,12 +112,18 @@ PACKAGES_FULL=(
 usage() {
     echo "Usage: $0 <device>"
     echo ""
-    echo "Devices:"
-    echo "  axt1800   GL.iNet GL-AXT1800 (Slate AX)    qualcommax/ipq60xx"
-    echo "  mt3000    GL.iNet GL-MT3000 (Beryl AX)      mediatek/filogic"
-    echo "  mt6000    GL.iNet GL-MT6000 (Flint 2)       mediatek/filogic"
-    echo "  ax6s      Xiaomi Redmi AX6S                 mediatek/filogic"
-    echo "  ax53u     Asus RT-AX53U                    ramips/mt7621"
+    echo "Devices:                                                          Role"
+    echo "  axt1800   GL.iNet GL-AXT1800 (Slate AX)    qualcommax/ipq60xx  Bumblebee"
+    echo "  mt3000    GL.iNet GL-MT3000 (Beryl AX)      mediatek/filogic   Bumblebee"
+    echo "  mt6000    GL.iNet GL-MT6000 (Flint 2)       mediatek/filogic   Bumblebee"
+    echo "  ax53u     Asus RT-AX53U                    ramips/mt7621       Bumblebee"
+    echo "  ar300m16  GL.iNet GL-AR300M16-EXT (16MB)   ath79/generic       Bee"
+    echo "  wr3000    Cudy AX3000 (WR3000)              mediatek/filogic   Bee"
+    echo "  cpe710    TP-Link CPE710 v1 (5GHz outdoor)  ath79/generic      Bee"
+    echo ""
+    echo "Roles:"
+    echo "  Bumblebee  L3 Gateway — full stack (yggdrasil, VPN, guest isolation, SQM, DoH)"
+    echo "  Bee        L2 Transport — minimal mesh relay (batman-adv, luci, heartbeat)"
     echo ""
     echo "OpenWrt version: ${OPENWRT_VERSION} (override with OPENWRT_VERSION env var)"
     echo ""
@@ -136,23 +161,105 @@ download_builder() {
 build_firmware() {
     local dir
     dir="$(builder_dir)"
-    local packages="${PACKAGES_FULL[*]} ${PACKAGES_EXTRA:-}"
+
+    # Select package list by role
+    local packages
+    if [ "$FIRMWARE_ROLE" = "bee" ]; then
+        packages="${PACKAGES_BEE[*]} ${PACKAGES_EXTRA:-}"
+    else
+        packages="${PACKAGES_BUMBLEBEE[*]} ${PACKAGES_EXTRA:-}"
+    fi
+
+    # Create temp FILES dir with role marker + version/profile
+    local tmpfiles
+    tmpfiles=$(mktemp -d)
+    cp -a "${PROJECT_DIR}/files/"* "$tmpfiles/"
+    mkdir -p "$tmpfiles/etc/parahub"
+    echo "$FIRMWARE_ROLE" > "$tmpfiles/etc/parahub/role"
+    echo "$FIRMWARE_VERSION" > "$tmpfiles/etc/parahub/version"
+    echo "$PROFILE" > "$tmpfiles/etc/parahub/profile"
+    echo "$PORT_MAP" > "$tmpfiles/etc/parahub/port_map"
 
     echo "Building firmware for profile: ${PROFILE}"
+    echo "Role: ${FIRMWARE_ROLE}"
     echo "Packages: ${packages}"
-    echo "Custom files: ${PROJECT_DIR}/files"
+    echo "Custom files: ${tmpfiles}"
 
     make -C "$dir" image \
         PROFILE="$PROFILE" \
         PACKAGES="$packages" \
-        FILES="${PROJECT_DIR}/files" \
+        FILES="$tmpfiles" \
         BIN_DIR="${PROJECT_DIR}/output"
 
+    rm -rf "$tmpfiles"
+
+    # Ensure output files are world-readable (served by nginx)
+    chmod 644 "${PROJECT_DIR}/output/"* 2>/dev/null || true
+
     echo ""
     echo "Build complete! Firmware images:"
     ls -lh "${PROJECT_DIR}/output/"*.bin 2>/dev/null || true
     ls -lh "${PROJECT_DIR}/output/"*.img* 2>/dev/null || true
     ls -lh "${PROJECT_DIR}/output/"*.itb 2>/dev/null || true
+
+    # Update manifest.json with this device's sysupgrade info
+    update_manifest
+}
+
+update_manifest() {
+    local manifest="${PROJECT_DIR}/output/manifest.json"
+    local sysupgrade_file sha256
+
+    # Find the sysupgrade.bin for this profile
+    sysupgrade_file=$(ls "${PROJECT_DIR}/output/"*"${PROFILE}"*-sysupgrade.bin 2>/dev/null | head -1)
+
+    if [ -z "$sysupgrade_file" ]; then
+        echo "Warning: No sysupgrade.bin found for ${PROFILE}, skipping manifest update"
+        return
+    fi
+
+    sha256=$(sha256sum "$sysupgrade_file" | cut -d' ' -f1)
+    local filename
+    filename=$(basename "$sysupgrade_file")
+
+    # Create or update manifest.json
+    if [ -f "$manifest" ]; then
+        # Update existing manifest — replace version + add/update device entry
+        local tmp
+        tmp=$(mktemp)
+        python3 -c "
+import json, sys
+with open('$manifest') as f:
+    m = json.load(f)
+m['version'] = '$FIRMWARE_VERSION'
+m.setdefault('devices', {})['$PROFILE'] = {
+    'sysupgrade': '$filename',
+    'sha256': '$sha256'
+}
+json.dump(m, sys.stdout, indent=2)
+" > "$tmp" && mv "$tmp" "$manifest"
+    else
+        # Create new manifest
+        python3 -c "
+import json, sys
+m = {
+    'version': '$FIRMWARE_VERSION',
+    'devices': {
+        '$PROFILE': {
+            'sysupgrade': '$filename',
+            'sha256': '$sha256'
+        }
+    }
+}
+json.dump(m, sys.stdout, indent=2)
+" > "$manifest"
+    fi
+
+    echo ""
+    echo "Manifest updated: ${manifest}"
+    echo "  Device: ${PROFILE}"
+    echo "  File:   ${filename}"
+    echo "  SHA256: ${sha256}"
 }
 
 # ============================================================================
@@ -173,6 +280,7 @@ fi
 
 echo "=== Parahub Mesh Firmware Builder ==="
 echo "Device:  ${INPUT}"
+echo "Role:    ${FIRMWARE_ROLE}"
 echo "OpenWrt: ${OPENWRT_VERSION}"
 echo "Target:  ${OPENWRT_TARGET}"
 echo "Profile: ${PROFILE}"