fix(wg): Use private_key instead of private_key_file (unsupported)

OpenWrt's WireGuard proto handler doesn't support private_key_file —
it auto-generates a new key, causing mismatch with the heartbeat pubkey.
Read key from file and set as inline private_key instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

files/etc/init.d/yggdrasil

@@ -0,0 +1,17 @@
+#!/bin/sh /etc/rc.common
+
+START=95
+STOP=10
+
+USE_PROCD=1
+CONF_FILE="/etc/yggdrasil.conf"
+
+start_service() {
+	[ -f "$CONF_FILE" ] || return 1
+	procd_open_instance
+	procd_set_param command /usr/sbin/yggdrasil -useconffile "$CONF_FILE"
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}

files/etc/sysupgrade.conf

@@ -1,3 +1,6 @@
-/etc/parahub/
+/etc/parahub/keys
+/etc/parahub/role
+/etc/parahub/wg_vps_private.key
+/etc/parahub/wg_vps_public.key
 /etc/yggdrasil.conf
 /etc/dropbear/

files/etc/uci-defaults/99-parahub-mesh

@@ -4,11 +4,9 @@
 # It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
 #
 # Roles:
-#   bumblebee (L3 Gateway) — full stack: yggdrasil, GRE6, VPN, guest isolation, SQM, DoH
+#   bumblebee (L3 Gateway) — full stack: yggdrasil, Mullvad VPN, guest isolation, speed control, DoH
 #   bee (L2 Transport)     — minimal: batman-adv mesh relay, heartbeat
 
-set -e
-
 # Read firmware role (written by build.sh)
 ROLE=$(cat /etc/parahub/role 2>/dev/null || echo "bumblebee")
 
@@ -23,9 +21,9 @@ BASE_MAC=$(cat /sys/class/net/br-lan/address 2>/dev/null || cat /sys/class/net/e
 NODE_SUFFIX=$(echo "$BASE_MAC" | awk -F: '{print toupper($5$6)}')
 
 HOSTNAME="Parahub-${NODE_SUFFIX}"
-PRIVATE_SSID="Parahub_${NODE_SUFFIX}"
-MESH_ID="parahub-mesh"
-PUBLIC_SSID="Parahub_Free"
+PRIVATE_SSID="Parahub"
+MESH_ID="parahub.io/mesh"
+PUBLIC_SSID="parahub.io/free"
 
 # ============================================================================
 # 2. SUBNET GENERATION (collision avoidance from MAC octets)
@@ -54,9 +52,12 @@ GUEST_IP="10.${GUEST_O1}.${GUEST_O2}.1"
 # 3. KEY GENERATION
 # ============================================================================
 
-PRIVATE_KEY=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 12)
+# Shared private WiFi key — same on all nodes for seamless 802.11r roaming
+PRIVATE_KEY="parahub.io"
 # Shared mesh SAE key — same across all Parahub nodes for auto-peering
 MESH_KEY="ndIPclyqSn9LaCki"
+# Random root password for SSH + LuCI (unique per node)
+ROOT_PASSWORD=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 16)
 
 mkdir -p /etc/parahub
 cat > /etc/parahub/keys <<KEYS_EOF
@@ -70,13 +71,63 @@ PRIVATE_SSID=${PRIVATE_SSID}
 PRIVATE_SUBNET=${PRIV_SUBNET}/24
 GUEST_SUBNET=${GUEST_SUBNET}/24
 NODE_MAC=${BASE_MAC}
+ROOT_PASSWORD=${ROOT_PASSWORD}
 KEYS_EOF
 chmod 600 /etc/parahub/keys
 
+# Set root password (secures SSH + LuCI)
+echo -e "${ROOT_PASSWORD}\n${ROOT_PASSWORD}" | passwd root >/dev/null 2>&1
+
+# Ensure dropbear directory has strict permissions (required for key auth)
+chmod 700 /etc/dropbear
+
+# Generate WireGuard keypair for VPS gateway (Bumblebee only)
+if [ "$ROLE" != "bee" ]; then
+    if [ ! -f /etc/parahub/wg_vps_private.key ]; then
+        umask 077
+        wg genkey > /etc/parahub/wg_vps_private.key
+        wg pubkey < /etc/parahub/wg_vps_private.key > /etc/parahub/wg_vps_public.key
+    fi
+fi
+
 # ============================================================================
 # 4. NETWORK CONFIGURATION
 # ============================================================================
 
+# --- Port mapping (written by build.sh per device) ---
+PORT_MAP=$(cat /etc/parahub/port_map 2>/dev/null || echo "eth0:lan eth1:wan")
+if [ "$PORT_MAP" = "dsa" ]; then
+    # DSA switch (ax53u) — individual ports
+    LAN_PORTS="lan1 lan2 lan3 lan4"
+    WAN_DEV="wan"
+else
+    # Parse port map: "eth0:wan eth1:lan" → extract LAN and WAN
+    LAN_PORTS=""
+    WAN_DEV=""
+    for mapping in $PORT_MAP; do
+        port="${mapping%%:*}"
+        role="${mapping##*:}"
+        if [ "$role" = "lan" ]; then
+            LAN_PORTS="$port"
+        elif [ "$role" = "wan" ]; then
+            WAN_DEV="$port"
+        fi
+    done
+    [ -z "$LAN_PORTS" ] && LAN_PORTS="eth0"
+    [ -z "$WAN_DEV" ] && WAN_DEV="eth1"
+fi
+
+# Delete default OpenWrt br-lan/lan (conflicts with our br-private)
+uci -q delete network.lan 2>/dev/null || true
+# Find and delete br-lan device
+for i in 0 1 2 3 4; do
+    name=$(uci -q get "network.@device[$i].name" 2>/dev/null)
+    if [ "$name" = "br-lan" ]; then
+        uci delete "network.@device[$i]"
+        break
+    fi
+done
+
 if [ "$ROLE" = "bee" ]; then
     # --- Bee: minimal network (bat0 gw_mode=client, no GRE6, no guest, no policy routing) ---
     uci batch <<-NET_EOF
@@ -114,7 +165,6 @@ set network.private_dev.type='bridge'
 set network.private_dev.name='br-private'
 delete network.private_dev.ports
 add_list network.private_dev.ports='bat0'
-add_list network.private_dev.ports='eth0'
 
 set network.private=interface
 set network.private.device='br-private'
@@ -124,12 +174,17 @@ set network.private.netmask='255.255.255.0'
 
 # --- wan (DHCP, create if missing) ---
 set network.wan=interface
-set network.wan.device='eth1'
+set network.wan.device='${WAN_DEV}'
 set network.wan.proto='dhcp'
 NET_EOF
 
+    # Add LAN ports to private bridge (DSA: lan1-4, non-DSA: eth0)
+    for port in $LAN_PORTS; do
+        uci add_list network.private_dev.ports="$port"
+    done
+
 else
-    # --- Bumblebee: full network (gw_mode=server, GRE6, guest, policy routing) ---
+    # --- Bumblebee: full network (gw_mode starts as client, promoted to server by gw-check when Mullvad is up) ---
     uci batch <<-NET_EOF
 # --- loopback ---
 set network.loopback=interface
@@ -138,14 +193,14 @@ set network.loopback.proto='static'
 set network.loopback.ipaddr='127.0.0.1'
 set network.loopback.netmask='255.0.0.0'
 
-# --- bat0 (batman-adv, server mode — acts as gateway for Bee nodes) ---
+# --- bat0 (batman-adv, starts as client — gw-check promotes to server when Mullvad is active) ---
 set network.bat0=interface
 set network.bat0.proto='batadv'
 set network.bat0.routing_algo='BATMAN_V'
 set network.bat0.aggregated_ogms='1'
 set network.bat0.bridge_loop_avoidance='1'
 set network.bat0.distributed_arp_table='1'
-set network.bat0.gw_mode='server'
+set network.bat0.gw_mode='client'
 set network.bat0.hop_penalty='15'
 set network.bat0.orig_interval='1000'
 
@@ -165,7 +220,6 @@ set network.private_dev.type='bridge'
 set network.private_dev.name='br-private'
 delete network.private_dev.ports
 add_list network.private_dev.ports='bat0'
-add_list network.private_dev.ports='eth0'
 
 set network.private=interface
 set network.private.device='br-private'
@@ -181,25 +235,28 @@ set network.guest.netmask='255.255.255.0'
 
 # --- wan (DHCP, create if missing) ---
 set network.wan=interface
-set network.wan.device='eth1'
+set network.wan.device='${WAN_DEV}'
 set network.wan.proto='dhcp'
 
-# --- GRE6 tunnel (guest traffic → VPS gateway via Yggdrasil) ---
-set network.vpn_tunnel=interface
-set network.vpn_tunnel.proto='grev6'
-set network.vpn_tunnel.peeraddr='200:39f1:6a26:328a:d901:fbd2:d30d:faef'
-set network.vpn_tunnel.ipaddr='172.16.0.2'
-set network.vpn_tunnel.netmask='255.255.255.0'
-set network.vpn_tunnel.gateway='172.16.0.1'
-set network.vpn_tunnel.mtu='1400'
-set network.vpn_tunnel.ip4table='100'
+# --- VPS gateway WireGuard (disabled until heartbeat activates it) ---
+set network.vps_gateway=interface
+set network.vps_gateway.proto='wireguard'
+set network.vps_gateway.private_key='$(cat /etc/parahub/wg_vps_private.key)'
+set network.vps_gateway.mtu='1420'
+set network.vps_gateway.ip4table='100'
+set network.vps_gateway.auto='0'
 
-# --- Policy routing: guest traffic → VPN table 100 ---
+# --- Policy routing: guest traffic → table 100 ---
 add network rule
 set network.@rule[-1].src='${GUEST_SUBNET}/24'
 set network.@rule[-1].lookup='100'
 set network.@rule[-1].priority='100'
 NET_EOF
+
+    # Add LAN ports to private bridge (DSA: lan1-4, non-DSA: eth0)
+    for port in $LAN_PORTS; do
+        uci add_list network.private_dev.ports="$port"
+    done
 fi
 
 uci commit network
@@ -245,12 +302,22 @@ fi
 # Remove all existing wifi-iface sections
 while uci -q delete wireless.@wifi-iface[0]; do :; done
 
-# Enable radios (remove disabled flag)
+# Enable radios and set fixed channels (all nodes must share same channel for mesh peering)
 for radio in $RADIOS; do
     uci -q delete "wireless.${radio}.disabled" 2>/dev/null || true
 done
 
-# --- 2.4GHz radio: mesh backhaul + Parahub_Free AP ---
+# Fixed channels — all mesh nodes must be on the same channel per band
+# 2.4GHz: channel 1 (DFS-free, least congested of 1/6/11)
+# 5GHz: channel 36 (DFS-free, universal chipset support)
+if [ -n "$RADIO_2G" ]; then
+    uci set "wireless.${RADIO_2G}.channel=1"
+fi
+if [ -n "$RADIO_5G" ]; then
+    uci set "wireless.${RADIO_5G}.channel=36"
+fi
+
+# --- 2.4GHz radio: mesh backhaul + parahub.io/free AP ---
 if [ -n "$RADIO_2G" ]; then
     # Mesh interface on 2.4GHz
     uci batch <<-WIFI_2G_MESH
@@ -265,25 +332,23 @@ set wireless.mesh_2g.network='bat0_hardif_mesh0'
 WIFI_2G_MESH
 
     if [ "$ROLE" = "bee" ]; then
-        # Bee: Parahub_Free on private bridge (no guest isolation)
+        # Bee: parahub.io/free on private bridge (no guest isolation)
         uci batch <<-WIFI_2G_PUB
 set wireless.public_2g=wifi-iface
 set wireless.public_2g.device='${RADIO_2G}'
 set wireless.public_2g.mode='ap'
 set wireless.public_2g.ssid='${PUBLIC_SSID}'
-set wireless.public_2g.encryption='owe'
-set wireless.public_2g.owe_transition='1'
+set wireless.public_2g.encryption='none'
 set wireless.public_2g.network='private'
 WIFI_2G_PUB
     else
-        # Bumblebee: Parahub_Free on guest network (isolated)
+        # Bumblebee: parahub.io/free on guest network (isolated)
         uci batch <<-WIFI_2G_PUB
 set wireless.public_2g=wifi-iface
 set wireless.public_2g.device='${RADIO_2G}'
 set wireless.public_2g.mode='ap'
 set wireless.public_2g.ssid='${PUBLIC_SSID}'
-set wireless.public_2g.encryption='owe'
-set wireless.public_2g.owe_transition='1'
+set wireless.public_2g.encryption='none'
 set wireless.public_2g.isolate='1'
 set wireless.public_2g.network='guest'
 WIFI_2G_PUB
@@ -304,16 +369,39 @@ set wireless.mesh_5g.key='${MESH_KEY}'
 set wireless.mesh_5g.network='bat0_hardif_mesh1'
 WIFI_5G_MESH
 
-    # Private AP on 5GHz (better throughput)
+    # Private AP on 5GHz (better throughput, 802.11r/k/v for seamless roaming)
     uci batch <<-WIFI_5G_PRIV
 set wireless.private_5g=wifi-iface
 set wireless.private_5g.device='${RADIO_5G}'
 set wireless.private_5g.mode='ap'
 set wireless.private_5g.ssid='${PRIVATE_SSID}'
-set wireless.private_5g.encryption='sae'
+set wireless.private_5g.encryption='sae-mixed'
 set wireless.private_5g.key='${PRIVATE_KEY}'
 set wireless.private_5g.network='private'
+set wireless.private_5g.ieee80211r='1'
+set wireless.private_5g.ft_over_ds='0'
+set wireless.private_5g.ft_psk_generate_local='1'
+set wireless.private_5g.mobility_domain='0a01'
+set wireless.private_5g.ieee80211k='1'
+set wireless.private_5g.ieee80211v='1'
 WIFI_5G_PRIV
+
+    # Private AP on 2.4GHz (range: outdoor, through walls)
+    uci batch <<-WIFI_2G_PRIV
+set wireless.private_2g=wifi-iface
+set wireless.private_2g.device='${RADIO_2G}'
+set wireless.private_2g.mode='ap'
+set wireless.private_2g.ssid='${PRIVATE_SSID}'
+set wireless.private_2g.encryption='sae-mixed'
+set wireless.private_2g.key='${PRIVATE_KEY}'
+set wireless.private_2g.network='private'
+set wireless.private_2g.ieee80211r='1'
+set wireless.private_2g.ft_over_ds='0'
+set wireless.private_2g.ft_psk_generate_local='1'
+set wireless.private_2g.mobility_domain='0a01'
+set wireless.private_2g.ieee80211k='1'
+set wireless.private_2g.ieee80211v='1'
+WIFI_2G_PRIV
 fi
 
 uci commit wireless
@@ -372,7 +460,7 @@ set firewall.@rule[-1].target='ACCEPT'
 FW_EOF
 
 else
-    # --- Bumblebee: full firewall (4 zones, guest isolation, kill switch) ---
+    # --- Bumblebee: full firewall (3 zones + mullvad_local added by parahub-mullvad, guest kill switch) ---
     uci batch <<-FW_EOF
 # --- Zone: lan (private network) ---
 add firewall zone
@@ -400,25 +488,25 @@ set firewall.@zone[-1].masq='1'
 set firewall.@zone[-1].mtu_fix='1'
 add_list firewall.@zone[-1].network='wan'
 
-# --- Zone: vpn_tunnel (GRE6 → VPS → Mullvad) ---
-add firewall zone
-set firewall.@zone[-1].name='vpn_tunnel'
-set firewall.@zone[-1].input='REJECT'
-set firewall.@zone[-1].output='ACCEPT'
-set firewall.@zone[-1].forward='REJECT'
-set firewall.@zone[-1].masq='1'
-set firewall.@zone[-1].mtu_fix='1'
-add_list firewall.@zone[-1].network='vpn_tunnel'
-
 # --- Forwarding: lan → wan (internet for owner) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='lan'
 set firewall.@forwarding[-1].dest='wan'
 
-# --- Forwarding: guest → vpn_tunnel ONLY (kill switch: no wan!) ---
+# --- Zone: vps_gateway (default VPN exit for guests, activated by heartbeat) ---
+add firewall zone
+set firewall.@zone[-1].name='vps_gateway'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='vps_gateway'
+
+# --- Forwarding: guest → vps_gateway (active once heartbeat enables interface) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='guest'
-set firewall.@forwarding[-1].dest='vpn_tunnel'
+set firewall.@forwarding[-1].dest='vps_gateway'
 
 # --- Rule: guest DHCP (allow guests to get IP) ---
 add firewall rule
@@ -605,7 +693,7 @@ if [ "$ROLE" != "bee" ]; then
     # Generate unique keys for this node
     yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
 
-    # Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
+    # Add VPS as static Yggdrasil peer (management plane: remote access, heartbeat)
     sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
 
     # UCI network interface for yggdrasil TUN
@@ -625,11 +713,20 @@ set firewall.@zone[-1].output='ACCEPT'
 set firewall.@zone[-1].forward='REJECT'
 add_list firewall.@zone[-1].network='yggdrasil'
 
-# Allow GRE6 protocol input (tunnel endpoint)
+# Allow SSH on Yggdrasil (remote management)
 add firewall rule
-set firewall.@rule[-1].name='Allow GRE6 input'
+set firewall.@rule[-1].name='Allow SSH Ygg'
 set firewall.@rule[-1].src='yggdrasil'
-set firewall.@rule[-1].proto='47'
+set firewall.@rule[-1].proto='tcp'
+set firewall.@rule[-1].dest_port='22'
+set firewall.@rule[-1].target='ACCEPT'
+
+# Allow HTTP on Yggdrasil (LuCI)
+add firewall rule
+set firewall.@rule[-1].name='Allow HTTP Ygg'
+set firewall.@rule[-1].src='yggdrasil'
+set firewall.@rule[-1].proto='tcp'
+set firewall.@rule[-1].dest_port='80'
 set firewall.@rule[-1].target='ACCEPT'
 
 # Allow ICMPv6 on Yggdrasil
@@ -657,7 +754,7 @@ YGG_FW_EOF
     uci commit firewall
 
     # Enable yggdrasil service
-    /etc/init.d/yggdrasil enable
+    /etc/init.d/yggdrasil enable 2>/dev/null || true
 
     # Save yggdrasil address to node keys file
     YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
@@ -703,9 +800,12 @@ fi
 
 chmod +x /usr/bin/parahub-heartbeat
 chmod +x /usr/bin/parahub-autoupdate
+chmod +x /usr/bin/parahub-gw-check
+chmod +x /usr/bin/parahub-vps-setup
 
-# Cron: heartbeat every 5 minutes + OTA update nightly at 3am
+# Cron: heartbeat every 5 min, gateway health check every 2 min, OTA nightly
 echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
+echo "*/2 * * * * /usr/bin/parahub-gw-check" >> /etc/crontabs/root
 echo "0 3 * * * /usr/bin/parahub-autoupdate" >> /etc/crontabs/root
 /etc/init.d/cron enable
 
@@ -720,16 +820,16 @@ logger -t parahub-mesh "Role: ${ROLE}"
 logger -t parahub-mesh "Private: ${PRIVATE_SSID} @ ${PRIV_IP}/24"
 
 if [ "$ROLE" = "bee" ]; then
-    logger -t parahub-mesh "Parahub_Free: bridged to private (no guest isolation)"
+    logger -t parahub-mesh "parahub.io/free: bridged to private (no guest isolation)"
     logger -t parahub-mesh "bat0 gw_mode: client (uses Bumblebee as gateway)"
 else
     logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
     logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
     logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
-    logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
-    logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
+    logger -t parahub-mesh "Guest internet: VPS gateway (auto-configured via heartbeat)"
+    logger -t parahub-mesh "Optional: parahub-mullvad setup for lower latency"
     logger -t parahub-mesh "Guest IPv6: Yggdrasil SLAAC (full speed, firewall restricted)"
-    logger -t parahub-mesh "bat0 gw_mode: server (gateway for Bee nodes)"
+    logger -t parahub-mesh "bat0 gw_mode: client (promoted to server by gw-check when WireGuard active)"
 fi
 
 exit 0

files/usr/bin/parahub-gw-check

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Parahub Gateway Health Check
+# Monitors WireGuard status (VPS gateway or Mullvad) and switches batman-adv gw_mode:
+#   - WireGuard active (recent handshake) → gw_mode=server (advertise as gateway)
+#   - WireGuard down or not configured    → gw_mode=client (relay only)
+#
+# Run via cron every 2 minutes. Bumblebee only.
+
+[ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || exit 0
+
+# Check if any WireGuard interface has a recent handshake
+WG_OK=0
+if command -v wg >/dev/null 2>&1; then
+    # Get latest handshake timestamp from any WireGuard interface
+    LAST_HS=$(wg show all latest-handshakes 2>/dev/null | awk '{print $NF}' | sort -rn | head -1)
+    if [ -n "$LAST_HS" ] && [ "$LAST_HS" -gt 0 ] 2>/dev/null; then
+        NOW=$(date +%s)
+        AGE=$((NOW - LAST_HS))
+        # Handshake within last 5 minutes = alive
+        [ "$AGE" -lt 300 ] && WG_OK=1
+    fi
+fi
+
+CURRENT_MODE=$(batctl gw_mode 2>/dev/null | awk '{print $1}')
+
+if [ "$WG_OK" = "1" ]; then
+    if [ "$CURRENT_MODE" != "server" ]; then
+        batctl gw_mode server
+        logger -t parahub-gw "WireGuard active, switched to gw_mode=server"
+    fi
+else
+    if [ "$CURRENT_MODE" != "client" ]; then
+        batctl gw_mode client
+        logger -t parahub-gw "WireGuard down, switched to gw_mode=client"
+    fi
+fi

files/usr/bin/parahub-heartbeat

@@ -19,6 +19,20 @@ UPTIME="$(cut -d. -f1 /proc/uptime)"
 MESH_IP=$(ip -4 addr show br-private 2>/dev/null | grep -o 'inet [0-9.]*' | cut -d' ' -f2)
 MESH_IP="${MESH_IP:-unknown}"
 
+# Generate WireGuard VPS keypair if missing (OTA from pre-VPS firmware)
+if [ "$ROLE" != "bee" ] && [ ! -f /etc/parahub/wg_vps_private.key ] && command -v wg >/dev/null 2>&1; then
+    umask 077
+    wg genkey > /etc/parahub/wg_vps_private.key
+    wg pubkey < /etc/parahub/wg_vps_private.key > /etc/parahub/wg_vps_public.key
+    logger -t parahub-heartbeat "Generated VPS WireGuard keypair (OTA migration)"
+fi
+
+# Read WireGuard VPS public key (Bumblebee only)
+WG_PUBKEY=""
+if [ -f /etc/parahub/wg_vps_public.key ]; then
+    WG_PUBKEY=$(cat /etc/parahub/wg_vps_public.key 2>/dev/null)
+fi
+
 # Detect hardware from board_name
 HW=$(cat /tmp/sysinfo/board_name 2>/dev/null)
 case "$HW" in
@@ -33,7 +47,7 @@ case "$HW" in
 esac
 
 FW_VERSION=$(cat /etc/parahub/version 2>/dev/null || echo "unknown")
-PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"${FW_VERSION}\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\"}"
+PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\":\"${YGG_ADDR}\",\"firmware_version\":\"${FW_VERSION}\",\"hardware_profile\":\"${HW}\",\"uptime\":${UPTIME},\"private_ssid\":\"${SSID}\",\"firmware_role\":\"${ROLE}\",\"mesh_ip\":\"${MESH_IP}\",\"wg_public_key\":\"${WG_PUBKEY}\"}"
 
 RESPONSE=""
 
@@ -70,3 +84,15 @@ if [ "$ROLE" != "bee" ] && [ -x /usr/bin/parahub-speed-control ] && [ -n "$RESPO
         parahub-speed-control add "$IP"
     done
 fi
+
+# VPS gateway auto-configuration (Bumblebee only, skip if Mullvad is configured)
+if [ "$ROLE" != "bee" ] && [ -n "$RESPONSE" ] && [ ! -f /etc/parahub/mullvad_account ]; then
+    VPS_ENDPOINT=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.endpoint' 2>/dev/null)
+    VPS_PUBKEY=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.public_key' 2>/dev/null)
+    VPS_IP=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.assigned_ip' 2>/dev/null)
+    VPS_KEEPALIVE=$(echo "$RESPONSE" | jsonfilter -e '$.vps_gateway.keepalive' 2>/dev/null)
+
+    if [ -n "$VPS_ENDPOINT" ] && [ -n "$VPS_PUBKEY" ] && [ -n "$VPS_IP" ]; then
+        /usr/bin/parahub-vps-setup "$VPS_ENDPOINT" "$VPS_PUBKEY" "$VPS_IP" "${VPS_KEEPALIVE:-25}"
+    fi
+fi

files/usr/bin/parahub-mullvad

@@ -3,7 +3,7 @@
 #
 # Allows the node owner to run Mullvad directly on the router.
 # Guest traffic routes through the local WireGuard tunnel instead of
-# the default GRE6→VPS path, giving lower latency and using the
+# the default VPS gateway path, giving lower latency and using the
 # nearest Mullvad server.
 #
 # Usage:
@@ -95,8 +95,8 @@ cmd_setup() {
     # --- Step 2: Register with Mullvad API ---
     echo "Registering key with Mullvad..."
     RESULT=$(curl -s --max-time 15 -X POST https://api.mullvad.net/wg/ \
-        -d "account=$ACCOUNT" \
-        -d "pubkey=$PUBKEY")
+        --data-urlencode "account=$ACCOUNT" \
+        --data-urlencode "pubkey=$PUBKEY")
 
     if echo "$RESULT" | grep -q "^[0-9]"; then
         MULLVAD_IPV4=$(echo "$RESULT" | cut -d',' -f1)
@@ -150,8 +150,8 @@ set network.@wireguard_mullvad_local[-1].route_allowed_ips='1'
 set network.@wireguard_mullvad_local[-1].persistent_keepalive='25'
 WG_EOF
 
-    # Disable GRE6 tunnel (WG replaces it in table 100)
-    uci set network.vpn_tunnel.auto='0'
+    # Disable VPS gateway (Mullvad replaces it in table 100)
+    uci -q set network.vps_gateway.auto='0' 2>/dev/null || true
     uci commit network
 
     # --- Step 6: Firewall zone for mullvad_local ---
@@ -196,7 +196,7 @@ ACCT_EOF
     echo ""
     echo "Done! Guest traffic now routes directly through Mullvad."
     echo "Server: $SERVER_HOST ($COUNTRY)"
-    echo "Test: connect to Parahub_Free, visit https://am.i.mullvad.net"
+    echo "Test: connect to parahub.io/free, visit https://am.i.mullvad.net"
 }
 
 # ============================================================================
@@ -213,8 +213,10 @@ cmd_status() {
         echo ""
         wg show mullvad_local 2>/dev/null || echo "WireGuard interface: not up"
     else
-        echo "Mode: VPS GATEWAY (GRE6 tunnel)"
-        echo "VPS: 91.98.123.238 -> Mullvad Portugal"
+        echo "Mode: VPS GATEWAY (WireGuard)"
+        echo "VPS: 185.47.131.84 -> Mullvad"
+        echo ""
+        wg show vps_gateway 2>/dev/null || echo "VPS gateway: not active"
     fi
 
     echo ""
@@ -222,6 +224,8 @@ cmd_status() {
     local fwd_idx
     if fwd_idx=$(find_guest_forwarding); then
         echo "  guest -> $(uci -q get "firewall.@forwarding[$fwd_idx].dest")"
+    else
+        echo "  (none)"
     fi
 }
 
@@ -241,8 +245,8 @@ cmd_remove() {
     uci -q delete network.mullvad_local 2>/dev/null || true
     while uci -q delete network.@wireguard_mullvad_local[0] 2>/dev/null; do :; done
 
-    # Re-enable GRE6 tunnel
-    uci -q delete network.vpn_tunnel.auto 2>/dev/null || true
+    # Re-enable VPS gateway
+    uci -q delete network.vps_gateway.auto 2>/dev/null || true
     uci commit network
 
     # Remove firewall zone
@@ -251,10 +255,10 @@ cmd_remove() {
         uci delete "firewall.@zone[$zone_idx]"
     fi
 
-    # Switch guest forwarding back to vpn_tunnel
+    # Switch guest forwarding back to vps_gateway
     local fwd_idx
     if fwd_idx=$(find_guest_forwarding); then
-        uci set "firewall.@forwarding[$fwd_idx].dest=vpn_tunnel"
+        uci set "firewall.@forwarding[$fwd_idx].dest=vps_gateway"
     fi
     uci commit firewall
 

files/usr/bin/parahub-vps-setup

@@ -0,0 +1,126 @@
+#!/bin/sh
+# Parahub Mesh — VPS WireGuard Gateway Setup
+# Called by heartbeat to auto-configure the VPS tunnel for guest internet.
+#
+# Usage: parahub-vps-setup <endpoint> <public_key> <assigned_ip> <keepalive>
+# Example: parahub-vps-setup 185.47.131.84:51820 <base64_key> 10.99.0.2/16 25
+
+ENDPOINT="$1"
+PUBKEY="$2"
+ASSIGNED_IP="$3"
+KEEPALIVE="${4:-25}"
+STATE_FILE="/tmp/vps_gateway_state"
+
+if [ -z "$ENDPOINT" ] || [ -z "$PUBKEY" ] || [ -z "$ASSIGNED_IP" ]; then
+    logger -t parahub-vps "Error: missing arguments"
+    exit 1
+fi
+
+# Check if config unchanged and interface is up — skip reconfiguration
+if [ -f "$STATE_FILE" ]; then
+    OLD_STATE=$(cat "$STATE_FILE")
+    NEW_STATE="${ENDPOINT}|${PUBKEY}|${ASSIGNED_IP}|${KEEPALIVE}"
+    if [ "$OLD_STATE" = "$NEW_STATE" ]; then
+        # Check if interface is actually up
+        if ip link show vps_gateway >/dev/null 2>&1; then
+            exit 0
+        fi
+    fi
+fi
+
+logger -t parahub-vps "Configuring VPS gateway: ${ENDPOINT} -> ${ASSIGNED_IP}"
+
+# Bootstrap: create interface + zone + forwarding if missing (OTA from pre-VPS firmware)
+if ! uci -q get network.vps_gateway >/dev/null 2>&1; then
+    logger -t parahub-vps "Bootstrap: creating vps_gateway interface (OTA upgrade)"
+    uci batch <<-BOOTSTRAP_NET
+set network.vps_gateway=interface
+set network.vps_gateway.proto='wireguard'
+set network.vps_gateway.private_key='$(cat /etc/parahub/wg_vps_private.key)'
+set network.vps_gateway.mtu='1420'
+set network.vps_gateway.ip4table='100'
+BOOTSTRAP_NET
+    uci commit network
+fi
+
+# Bootstrap firewall zone if missing
+ZONE_EXISTS=0
+idx=0
+while uci -q get "firewall.@zone[$idx]" >/dev/null 2>&1; do
+    zname=$(uci -q get "firewall.@zone[$idx].name")
+    if [ "$zname" = "vps_gateway" ]; then
+        ZONE_EXISTS=1
+        break
+    fi
+    idx=$((idx + 1))
+done
+
+if [ "$ZONE_EXISTS" = "0" ]; then
+    logger -t parahub-vps "Bootstrap: creating vps_gateway firewall zone"
+    uci batch <<-BOOTSTRAP_FW
+add firewall zone
+set firewall.@zone[-1].name='vps_gateway'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='vps_gateway'
+BOOTSTRAP_FW
+
+    # Add guest → vps_gateway forwarding if no guest forwarding exists
+    FWD_EXISTS=0
+    fidx=0
+    while uci -q get "firewall.@forwarding[$fidx]" >/dev/null 2>&1; do
+        src=$(uci -q get "firewall.@forwarding[$fidx].src")
+        if [ "$src" = "guest" ]; then
+            FWD_EXISTS=1
+            break
+        fi
+        fidx=$((fidx + 1))
+    done
+
+    if [ "$FWD_EXISTS" = "0" ]; then
+        uci add firewall forwarding >/dev/null
+        uci set "firewall.@forwarding[-1].src=guest"
+        uci set "firewall.@forwarding[-1].dest=vps_gateway"
+    fi
+
+    uci commit firewall
+fi
+
+# Remove old peer sections
+while uci -q delete network.@wireguard_vps_gateway[0] 2>/dev/null; do :; done
+
+# Set address and add peer
+uci -q delete network.vps_gateway.addresses 2>/dev/null || true
+uci add_list network.vps_gateway.addresses="${ASSIGNED_IP}"
+
+# Split endpoint into host:port
+EP_HOST="${ENDPOINT%:*}"
+EP_PORT="${ENDPOINT##*:}"
+
+uci batch <<-PEER_EOF
+add network wireguard_vps_gateway
+set network.@wireguard_vps_gateway[-1].public_key='${PUBKEY}'
+set network.@wireguard_vps_gateway[-1].endpoint_host='${EP_HOST}'
+set network.@wireguard_vps_gateway[-1].endpoint_port='${EP_PORT}'
+add_list network.@wireguard_vps_gateway[-1].allowed_ips='0.0.0.0/0'
+set network.@wireguard_vps_gateway[-1].route_allowed_ips='1'
+set network.@wireguard_vps_gateway[-1].persistent_keepalive='${KEEPALIVE}'
+PEER_EOF
+
+# Enable interface (remove auto='0')
+uci -q delete network.vps_gateway.auto 2>/dev/null || true
+uci commit network
+
+# Bring up the interface (minimal restart)
+ifup vps_gateway 2>/dev/null
+
+# Reload firewall rules
+fw4 reload 2>/dev/null
+
+# Save state for next run
+echo "${ENDPOINT}|${PUBKEY}|${ASSIGNED_IP}|${KEEPALIVE}" > "$STATE_FILE"
+
+logger -t parahub-vps "VPS gateway activated: ${ASSIGNED_IP} via ${ENDPOINT}"

scripts/build.sh

@@ -11,6 +11,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 
 OPENWRT_VERSION="${OPENWRT_VERSION:-25.12.0-rc4}"
+PARAHUB_BUILD="4"
+FIRMWARE_VERSION="${OPENWRT_VERSION}-ph${PARAHUB_BUILD}"
 
 # ============================================================================
 # Device Database (device → target/subtarget + Image Builder profile)
@@ -23,41 +25,43 @@ device_config() {
             OPENWRT_TARGET="qualcommax/ipq60xx"
             PROFILE="glinet_gl-axt1800"
             FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="eth0:lan eth1:wan"
             ;;
         mt3000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="glinet_gl-mt3000"
             FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="eth0:wan eth1:lan"
             ;;
         mt6000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="glinet_gl-mt6000"
             FIRMWARE_ROLE="bumblebee"
-            ;;
-        ax6s)
-            OPENWRT_TARGET="mediatek/mt7622"
-            PROFILE="xiaomi_redmi-router-ax6s"
-            FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="eth0:wan eth1:lan"
             ;;
         ax53u)
             OPENWRT_TARGET="ramips/mt7621"
             PROFILE="asus_rt-ax53u"
             FIRMWARE_ROLE="bumblebee"
+            PORT_MAP="dsa"
             ;;
         ar300m16)
             OPENWRT_TARGET="ath79/generic"
             PROFILE="glinet_gl-ar300m16"
             FIRMWARE_ROLE="bee"
+            PORT_MAP="eth0:lan eth1:wan"
             ;;
         wr3000)
             OPENWRT_TARGET="mediatek/filogic"
             PROFILE="cudy_wr3000-v1"
             FIRMWARE_ROLE="bee"
+            PORT_MAP="eth0:wan eth1:lan"
             ;;
         cpe710)
             OPENWRT_TARGET="ath79/generic"
             PROFILE="tplink_cpe710-v1"
             FIRMWARE_ROLE="bee"
+            PORT_MAP="eth0:lan eth1:wan"
             ;;
         *)
             return 1
@@ -112,7 +116,6 @@ usage() {
     echo "  axt1800   GL.iNet GL-AXT1800 (Slate AX)    qualcommax/ipq60xx  Bumblebee"
     echo "  mt3000    GL.iNet GL-MT3000 (Beryl AX)      mediatek/filogic   Bumblebee"
     echo "  mt6000    GL.iNet GL-MT6000 (Flint 2)       mediatek/filogic   Bumblebee"
-    echo "  ax6s      Xiaomi Redmi AX6S                 mediatek/mt7622    Bumblebee"
     echo "  ax53u     Asus RT-AX53U                    ramips/mt7621       Bumblebee"
     echo "  ar300m16  GL.iNet GL-AR300M16-EXT (16MB)   ath79/generic       Bee"
     echo "  wr3000    Cudy AX3000 (WR3000)              mediatek/filogic   Bee"
@@ -173,8 +176,9 @@ build_firmware() {
     cp -a "${PROJECT_DIR}/files/"* "$tmpfiles/"
     mkdir -p "$tmpfiles/etc/parahub"
     echo "$FIRMWARE_ROLE" > "$tmpfiles/etc/parahub/role"
-    echo "$OPENWRT_VERSION" > "$tmpfiles/etc/parahub/version"
+    echo "$FIRMWARE_VERSION" > "$tmpfiles/etc/parahub/version"
     echo "$PROFILE" > "$tmpfiles/etc/parahub/profile"
+    echo "$PORT_MAP" > "$tmpfiles/etc/parahub/port_map"
 
     echo "Building firmware for profile: ${PROFILE}"
     echo "Role: ${FIRMWARE_ROLE}"
@@ -189,6 +193,9 @@ build_firmware() {
 
     rm -rf "$tmpfiles"
 
+    # Ensure output files are world-readable (served by nginx)
+    chmod 644 "${PROJECT_DIR}/output/"* 2>/dev/null || true
+
     echo ""
     echo "Build complete! Firmware images:"
     ls -lh "${PROJECT_DIR}/output/"*.bin 2>/dev/null || true
@@ -224,7 +231,7 @@ update_manifest() {
 import json, sys
 with open('$manifest') as f:
     m = json.load(f)
-m['version'] = '$OPENWRT_VERSION'
+m['version'] = '$FIRMWARE_VERSION'
 m.setdefault('devices', {})['$PROFILE'] = {
     'sysupgrade': '$filename',
     'sha256': '$sha256'
@@ -236,7 +243,7 @@ json.dump(m, sys.stdout, indent=2)
         python3 -c "
 import json, sys
 m = {
-    'version': '$OPENWRT_VERSION',
+    'version': '$FIRMWARE_VERSION',
     'devices': {
         '$PROFILE': {
             'sysupgrade': '$filename',