# WireGuard Backup Fallback Strategy

The home router backup script (`/root/.hermes/scripts/wisp-backup/wisp-backup.py`) now attempts WireGuard first before falling back to L2TP/IPsec.

## Why

WireGuard is always-on (persistent keepalive), lower latency, and already configured. The old L2TP/IPsec connection was failing because the ppp0 interface never negotiated. Rather than debug L2TP, we use the working WireGuard tunnel and keep L2TP as a dead-code fallback.

## How it works (in main())

The change was in `main()` — Step 1 of the backup process:

```python
# Step 1: Try WireGuard first
vpn_was_connected = False
router_ip = cfg['towers'][0]['ip']  # e.g. 10.77.0.2
ping_check = subprocess.run(
    ["ping", "-c", "1", "-W", "2", router_ip],
    capture_output=True, timeout=5
)
if ping_check.returncode == 0:
    print(f"  [+] Router reachable at {router_ip} via WireGuard — skipping VPN")
else:
    print("  [-] Router not reachable, trying L2TP/IPsec VPN ...")
    if not run_vpn_script("up", script_dir):
        print("[-] VPN connection failed. Aborting.")
        sys.exit(1)
    vpn_was_connected = True
```

## Tracking `vpn_was_connected`

The variable tracks whether WE brought up the VPN, so we don't tear it down at the end if WireGuard was already active:

- All `run_vpn_script("down", script_dir)` calls are now gated: `if vpn_was_connected:`
- Exits, dry-runs, and the final cleanup all check before tearing down

## WireGuard status

- Interface: wg0 on Core (152.53.192.33)
- Peer: home router at 76.195.7.60:13231
- Handshake: every ~2 minutes
- Router IP over tunnel: 10.77.0.2
- Allowed IPs: 10.77.0.2/32, 10.10.10.0/24