travel router

host/wg0.conf.example

@@ -3,7 +3,8 @@
 # paste in each site's public key afterwards.
 
 [Interface]
-Address = 172.31.255.1/24
+# .255 = site transfer net, .9 = roaming WG peers (travel routers)
+Address = 172.31.255.1/24, 172.31.9.1/24
 ListenPort = 51820
 PrivateKey = <RACKNERD_WG_PRIVATE_KEY>
 # wg-quick auto-adds routes for each peer's AllowedIPs — that is exactly
@@ -25,3 +26,11 @@ AllowedIPs = 172.31.255.3/32, 192.168.7.0/24
 # Deliberately NOT listing the other site's LAN under either peer:
 # Oswald<->Trochalakis traffic must stay on their direct tunnel, never
 # hairpin through this box.
+
+# ── Travel routers (roaming /32 peers from 172.31.9.0/24) ──
+# The Ansible deploy appends these from the wg_travel_peers list in
+# group_vars. For manual setups, copy this block per router:
+#[Peer]  # glinet-1
+#PublicKey = <ROUTER_WG_PUBLIC_KEY>
+#AllowedIPs = 172.31.9.11/32
+# (no Endpoint — routers initiate and keep alive from behind NAT)