travel router

docs/SITE-SIDE.md

@@ -13,7 +13,8 @@ Add the RackNerd peer to each site's existing WG config. The sites
 [Peer]                       # RackNerd hub
 PublicKey = <RACKNERD_WG_PUBLIC_KEY>       # printed by host/setup.sh
 Endpoint = vpn.atlashorizon.net:51820
-AllowedIPs = 172.31.255.1/32, 172.31.8.0/24
+# .8 = OpenVPN clients, .9 = travel routers (docs/TRAVEL-ROUTERS.md)
+AllowedIPs = 172.31.255.1/32, 172.31.8.0/24, 172.31.9.0/24
 PersistentKeepalive = 25
 ```
 
@@ -35,6 +36,7 @@ LAN router (or directly on the DCs):
 | Destination      | Via                    |
 |------------------|------------------------|
 | `172.31.8.0/24`  | site WireGuard box     |
+| `172.31.9.0/24`  | site WireGuard box     |
 | `172.31.255.1/32`| site WireGuard box     |
 
 Verify no asymmetry: `tracert 172.31.8.10` from a DC must leave via the
@@ -42,9 +44,10 @@ local WG box → RackNerd, never via the other site.
 
 ## 3. Windows Firewall / segmentation on the DCs
 
-Allow from **`172.31.8.0/24`** (roaming clients, real source IPs): standard
-AD client ports — DNS 53, Kerberos 88/464, LDAP 389/636, SMB 445, RPC 135 +
-49152-65535, NTP 123, GC 3268/3269.
+Allow from **`172.31.8.0/24`** (OpenVPN clients, real source IPs) and
+**`172.31.9.0/24`** (travel routers): standard AD client ports — DNS 53,
+Kerberos 88/464, LDAP 389/636, SMB 445, RPC 135 + 49152-65535, NTP 123,
+GC 3268/3269.
 
 Allow from **`172.31.255.1/32`** (the RackNerd host itself):
 - TCP/UDP 53 → AHDC01, AHDC03, AH-OSWLDC (Technitium forwarder queries)

docs/TRAVEL-ROUTERS.md

@@ -0,0 +1,65 @@
+# Travel routers (GL.iNet) as roaming WireGuard peers
+
+The three GL.iNet routers connect to the hub as always-on WireGuard
+clients from `172.31.9.0/24` (hub = `172.31.9.1`). They are roaming
+*clients*, not sites: they initiate to the hub, carry no LAN routes of
+their own on the hub side, and NAT their attached devices behind their
+single WG address — so the DCs see one IP per router.
+
+Security model (be aware): unlike OpenVPN users there is **no Duo** here —
+possession of the router's private key is the whole credential. Each
+router has its own keypair; if one is lost, remove its entry from
+`wg_travel_peers` and re-run the playbook — that revokes it completely.
+
+## Hub side (all via Ansible)
+
+1. Generate a keypair per router — in the GL.iNet UI (it shows the public
+   key) or manually: `wg genkey | tee priv | wg pubkey`.
+2. Fill `wg_travel_peers` in `group_vars/vpnhub.yml`:
+   ```yaml
+   wg_travel_peers:
+     - { name: glinet-1, public_key: "xxxx=", ip: 172.31.9.11 }
+     - { name: glinet-2, public_key: "yyyy=", ip: 172.31.9.12 }
+     - { name: glinet-3, public_key: "zzzz=", ip: 172.31.9.13 }
+   ```
+3. `ansible-playbook site.yml` — appends the peers to wg0.conf (restarts
+   wg0: brief blip for all tunnels), adds the firewall forwards, and
+   registers `<name>.roam.atlashorizon.net` A + PTR records.
+4. **Existing deploys only**: add `172.31.9.0/24` to the Technitium
+   recursion ACL by hand (console → Settings → Recursion) — that setting
+   was seeded at first boot and isn't re-read from the compose env.
+
+## Router side (paste into the GL.iNet WireGuard client UI)
+
+```ini
+[Interface]
+PrivateKey = <this router's private key>
+Address = 172.31.9.11/24          # .12 / .13 for the others
+DNS = 172.31.9.1                  # Technitium — AD names resolve
+
+[Peer]
+PublicKey = <RACKNERD_WG_PUBLIC_KEY>      # printed by setup/playbook
+Endpoint = vpn.atlashorizon.net:51820
+# Split tunnel: both sites + the hub nets. Use 0.0.0.0/0 instead for
+# full tunnel (all hotel traffic exits via the VPS).
+AllowedIPs = 192.168.20.0/24, 192.168.7.0/24, 172.31.9.0/24, 172.31.255.1/32
+PersistentKeepalive = 25
+```
+
+## Site side (once, both sites — same drill as the OpenVPN subnet)
+
+- Add `172.31.9.0/24` to the RackNerd peer's AllowedIPs in each site's
+  WG config.
+- Return route: `172.31.9.0/24` via the site WG box (LAN router or DCs).
+- DC/Windows firewall: allow AD ports from `172.31.9.0/24`.
+- Optional: AD Sites & Services subnet object for `172.31.9.0/24`.
+
+## Verify
+
+```bash
+wg show wg0                        # router peers: recent handshakes
+ping 172.31.9.11                   # from the hub
+dig @127.0.0.1 -x 172.31.9.11 +short   # glinet-1.roam.atlashorizon.net.
+# from a device behind the router:
+#   ping ahdc01.ad.atlashorizon.net  (resolves via 172.31.9.1, routes via hub)
+```