# Travel routers (GL.iNet) as roaming WireGuard peers

The three GL.iNet routers connect to the hub as always-on WireGuard
clients from `172.31.9.0/24` (hub = `172.31.9.1`). They are roaming
*clients*, not sites: they initiate to the hub, carry no LAN routes of
their own on the hub side, and NAT their attached devices behind their
single WG address — so the DCs see one IP per router.

Security model (be aware): unlike OpenVPN users there is **no Duo** here —
possession of the router's private key is the whole credential. Each
router has its own keypair; if one is lost, remove its entry from
`wg_travel_peers` and re-run the playbook — that revokes it completely.

## Hub side (all via Ansible)

1. Generate a keypair per router — in the GL.iNet UI (it shows the public
   key) or manually: `wg genkey | tee priv | wg pubkey`.
2. Fill `wg_travel_peers` in `group_vars/vpnhub.yml`:
   ```yaml
   wg_travel_peers:
     - { name: glinet-1, public_key: "xxxx=", ip: 172.31.9.11 }
     - { name: glinet-2, public_key: "yyyy=", ip: 172.31.9.12 }
     - { name: glinet-3, public_key: "zzzz=", ip: 172.31.9.13 }
   ```
3. `ansible-playbook site.yml` — appends the peers to wg0.conf (restarts
   wg0: brief blip for all tunnels), adds the firewall forwards, and
   registers `<name>.roam.atlashorizon.net` A + PTR records.
4. **Existing deploys only**: add `172.31.9.0/24` to the Technitium
   recursion ACL by hand (console → Settings → Recursion) — that setting
   was seeded at first boot and isn't re-read from the compose env.

## Router side (paste into the GL.iNet WireGuard client UI)

```ini
[Interface]
PrivateKey = <this router's private key>
Address = 172.31.9.11/24          # .12 / .13 for the others
DNS = 172.31.9.1                  # Technitium — AD names resolve

[Peer]
PublicKey = <RACKNERD_WG_PUBLIC_KEY>      # printed by setup/playbook
Endpoint = vpn.atlashorizon.net:51820
# Split tunnel: both sites + the hub nets. Use 0.0.0.0/0 instead for
# full tunnel (all hotel traffic exits via the VPS).
AllowedIPs = 192.168.20.0/24, 192.168.7.0/24, 172.31.9.0/24, 172.31.255.1/32
PersistentKeepalive = 25
```

## Site side (once, both sites — same drill as the OpenVPN subnet)

- Add `172.31.9.0/24` to the RackNerd peer's AllowedIPs in each site's
  WG config.
- Return route: `172.31.9.0/24` via the site WG box (LAN router or DCs).
- DC/Windows firewall: allow AD ports from `172.31.9.0/24`.
- Optional: AD Sites & Services subnet object for `172.31.9.0/24`.

## Verify

```bash
wg show wg0                        # router peers: recent handshakes
ping 172.31.9.11                   # from the hub
dig @127.0.0.1 -x 172.31.9.11 +short   # glinet-1.roam.atlashorizon.net.
# from a device behind the router:
#   ping ahdc01.ad.atlashorizon.net  (resolves via 172.31.9.1, routes via hub)
```