From 7f446b9a08e7f1c3f7b486f8c72635cc0e305c03 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Wed, 8 Apr 2026 18:37:18 +0300
Subject: Add Pi gateway peers to mesh generator

---
 wireguardmeshgenerator.rb   |  8 ++++++-
 wireguardmeshgenerator.yaml | 52 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 1 deletion(-)

diff --git a/wireguardmeshgenerator.rb b/wireguardmeshgenerator.rb
index cb0f819..c4dc11a 100644
--- a/wireguardmeshgenerator.rb
+++ b/wireguardmeshgenerator.rb
@@ -245,6 +245,7 @@ InstallConfig = Struct.new(:myself, :hosts) do
     @myself = myself
 
     data = hosts[myself]
+    @os = data['os']
     domain = data.dig('lan', 'domain') || data.dig('internet', 'domain')
     @fqdn = "#{myself}.#{domain}"
     @ssh_user = data['ssh']['user']
@@ -265,13 +266,18 @@ InstallConfig = Struct.new(:myself, :hosts) do
   # Ensures the configuration directory exists and has the correct permissions.
   def install!
     puts "Installing Wireguard config on #{@myself}"
+    owner_group = @os == 'Linux' ? 'root:root' : 'root:wheel'
     ssh <<~SH
       if [ ! -d #{@conf_dir} ]; then
         #{@sudo_cmd} mkdir -p #{@conf_dir}
       fi
       #{@sudo_cmd} chmod 700 #{@conf_dir}
       #{@sudo_cmd} mv -v wg0.conf #{@conf_dir}
-      #{@sudo_cmd} chmod 644 #{@conf_dir}/wg0.conf
+      #{@sudo_cmd} chown #{owner_group} #{@conf_dir}/wg0.conf
+      #{@sudo_cmd} chmod 600 #{@conf_dir}/wg0.conf
+      if command -v restorecon >/dev/null 2>&1; then
+        #{@sudo_cmd} restorecon -v #{@conf_dir}/wg0.conf || true
+      fi
     SH
   end
 
diff --git a/wireguardmeshgenerator.yaml b/wireguardmeshgenerator.yaml
index c33c301..34a0a07 100644
--- a/wireguardmeshgenerator.yaml
+++ b/wireguardmeshgenerator.yaml
@@ -211,3 +211,55 @@ hosts:
     # Note: No 'lan' or 'internet' section = roaming client
     # Note: No 'ssh' section = manual installation
     # Note: gateway: false = connect to gateways but don't route internet through them
+  pi0:
+    os: Linux
+    ssh:
+      user: paul
+      conf_dir: /etc/wireguard
+      sudo_cmd: sudo
+      reload_cmd: systemctl reload wg-quick@wg0.service
+    lan:
+      domain: 'lan.buetow.org'
+      ip: '192.168.1.125'
+    wg0:
+      domain: 'wg0.wan.buetow.org'
+      ip: '192.168.2.203'
+      ipv6: 'fd42:beef:cafe:2::203'
+    exclude_peers:
+      - f0
+      - f1
+      - f2
+      - f3
+      - r0
+      - r1
+      - r2
+      - earth
+      - pixel7pro
+      - freebsd
+      - pi1
+  pi1:
+    os: Linux
+    ssh:
+      user: paul
+      conf_dir: /etc/wireguard
+      sudo_cmd: sudo
+      reload_cmd: systemctl reload wg-quick@wg0.service
+    lan:
+      domain: 'lan.buetow.org'
+      ip: '192.168.1.126'
+    wg0:
+      domain: 'wg0.wan.buetow.org'
+      ip: '192.168.2.204'
+      ipv6: 'fd42:beef:cafe:2::204'
+    exclude_peers:
+      - f0
+      - f1
+      - f2
+      - f3
+      - r0
+      - r1
+      - r2
+      - earth
+      - pixel7pro
+      - freebsd
+      - pi0
-- 
cgit v1.2.3