feat(mesh): irv-ml1 wg0 non-reboot-restorable + Irvine subnet discovery (bidirectional, verified)

2026-09-06 01:02:50 -07:00
parent b2c819ed51
commit 02cf9d6cfb
1 changed files with 17 additions and 0 deletions
@@ -385,3 +385,20 @@ commented out.
 kill the independent lifeline; use tailscale `--socks5-server`+exit-node or a per-container netns);
 then bring YTVC back. On-site: decide whether to keep the reverse tunnel + UDM forward + revtun key
 or remove them (small WAN attack surface, src-restricted). Fully retire wg0 config if desired.
+
+## 2026-09-06 — wg0 made non-reboot-restorable + Irvine subnet discovery (operator corrections)
+
+**wg0 no longer reboot-restorable** (supersedes the earlier "wg-quick@wg0 stays enabled" note):
+`systemctl disable wg-quick@wg0` on irv-ml1 — the cutover is real, wg0 does not silently return on
+reboot. Config `/etc/wireguard/wg0.conf` retained so the failover paths can still bring it up. The
+FAILOVER is now: `wg0-watchdog.service` (`wg-quick up wg0` if the fleet is unreachable over the mesh
+~5min — works regardless of the unit's enable state) + the independent reverse tunnel. Rationale
+(operator): reboot-restore was redundant with the watchdog and made the cutover half-real; accept-routes
+table-52 would keep the mesh primary anyway, but a clean cutover shouldn't resurrect the retired tunnel.
+
+**Irvine subnet discovery LIVE (bidirectional):** irv-ml1 now `--advertise-routes=10.6.110.0/24`
+(approved on headscale, serving; ip_forward=1; default SNAT-on so mesh-unaware Irvine hosts reply to
+irv-ml1). Fleet-wide reach added via gateway static routes `10.6.110.0/24 → local mesh router`
+(NH3 UDM→nh3-scale, ESH UDM→esh-scale, FortiGate route 22→ana-scale). Verified: ana-docker→10.6.110.1
+and esh-docker-vm→10.6.110.50 both OK over the mesh. So irv-ml1 both REACHES the fleet /16s
+(accept-routes) and EXPOSES its Irvine LAN to the fleet (advertise-routes) — a full mesh subnet router.