Initial skills documentation — 25 categories, all SKILL.md + references + scripts

2026-07-15 17:42:20 -04:00
commit 1b4fcd4427
976 changed files with 188344 additions and 0 deletions
@@ -0,0 +1,35 @@
+# WireGuard Backup Pipe for Home Router
+
+Deployed Jul 9, 2026. The home router backup now uses WireGuard instead of L2TP/IPsec.
+
+## Why WireGuard over L2TP/IPsec
+
+- WireGuard is always-on — no tunnel setup/teardown delay (handshake happens in seconds)
+- L2TP/IPsec was failing to bring up `ppp0` interface despite IPsec phase succeeding
+- WireGuard was already configured on both sides — the backup script just wasn't using it
+- Lower latency: 37ms vs longer for multi-protocol negotiation
+
+## How the backup script chooses
+
+The modified `wisp-backup.py` now:
+
+1. Pings the router at `10.77.0.2` (WireGuard tunnel IP) with a 2-second timeout
+2. If reachable — skips VPN entirely, uses WireGuard directly
+3. If unreachable — falls back to L2TP/IPsec VPN
+4. Tracks `vpn_was_connected` flag to avoid unnecessary VPN teardown
+
+## WireGuard peer status
+
+- Local interface: `wg0` on Core (152.53.192.33)
+- Peer: home router at `76.195.7.60:13231`
+- Allowed IPs: `10.77.0.2/32, 10.10.10.0/24`
+- Key commands:
+  - `wg show` — see peer status + latest handshake time
+  - `ping 10.77.0.2` — test connectivity
+  - `ssh -i /root/.ssh/wisp_rsa shonuff@10.77.0.2` — SSH to router
+
+## Pitfalls
+
+- The old `run_vpn_script("down", script_dir)` calls ran unconditionally even when WireGuard was active. All exit paths (error, dry-run, normal) need a `vpn_was_connected` guard.
+- WireGuard handshake freshness: if > 5 min since last handshake, the tunnel may be down and the backup will fall back to L2TP.
+- The router uses port 13231 for WireGuard, not the default 51820.