From 747d73890f792d867aa30728d8d0157d561a19ea Mon Sep 17 00:00:00 2001
From: jdl <jdl@desktop>
Date: Sun, 7 Jun 2026 20:01:51 +0200
Subject: [PATCH] Bug fixes, removed old files.

---
 cmd/vppn/main.go                        |   2 +
 hub/templates/network/network-view.html |  14 +-
 hub/templates/network/peer-create.html  |  16 +--
 hub/templates/network/peer-edit.html    |  16 +--
 hub/templates/network/peer-view.html    |   7 +-
 peer/files.go                           |  98 -------------
 peer/globals.go                         |  41 ------
 peer/holepunch.go                       | 157 ---------------------
 peer/hubpoller.go                       | 146 -------------------
 peer/mcreader.go                        |  68 ---------
 peer/mcwriter.go                        |  45 ------
 peer/wgdev.go                           | 179 ------------------------
 12 files changed, 23 insertions(+), 766 deletions(-)
 delete mode 100644 peer/files.go
 delete mode 100644 peer/globals.go
 delete mode 100644 peer/holepunch.go
 delete mode 100644 peer/hubpoller.go
 delete mode 100644 peer/mcreader.go
 delete mode 100644 peer/mcwriter.go
 delete mode 100644 peer/wgdev.go

diff --git a/cmd/vppn/main.go b/cmd/vppn/main.go
index ca28299..bd16125 100644
--- a/cmd/vppn/main.go
+++ b/cmd/vppn/main.go
@@ -22,6 +22,8 @@ func main() {
 		os.Exit(1)
 	}
 
+	// TODO: Acquire flock on lock file.
+
 	statePath := networkStatePath(*name)
 
 	state, err := peer.LoadOrInit(statePath, *hub, *apiKey)
diff --git a/hub/templates/network/network-view.html b/hub/templates/network/network-view.html
index 1dc453d..dc3f22a 100644
--- a/hub/templates/network/network-view.html
+++ b/hub/templates/network/network-view.html
@@ -22,10 +22,9 @@
     <tr>
       <th>PeerIP</th>
       <th>Name</th>
-      <th>Public IP 1</th>
-      <th>Port 1</th>
-      <th>Public IP 2</th>
-      <th>Port 2</th>
+      <th>IPv4</th>
+      <th>IPv6</th>
+      <th>Port</th>
       <th>Relay</th>
     </tr>
   </thead>
@@ -38,10 +37,9 @@
       </a>
     </td>
     <td>{{.Name}}</td>
-    <td>{{ipToString .PublicIP1}}</td>
-    <td>{{.Port1}}</td>
-    <td>{{ipToString .PublicIP2}}</td>
-    <td>{{.Port2}}</td>
+    <td>{{ipToString .Addr4}}</td>
+    <td>{{ipToString .Addr6}}</td>
+    <td>{{.Port}}</td>
     <td>{{if .Relay}}T{{else}}F{{end}}</td>
   </tr>
   </tbody>
diff --git a/hub/templates/network/peer-create.html b/hub/templates/network/peer-create.html
index ed6dd1b..303cb6e 100644
--- a/hub/templates/network/peer-create.html
+++ b/hub/templates/network/peer-create.html
@@ -12,20 +12,16 @@
     <input type="text" name="Name">
   </p>
   <p>
-    <label>Public IP 1</label><br>
-    <input type="text" name="PublicIP1">
+    <label>IPv4 Address (optional)</label><br>
+    <input type="text" name="Addr4">
   </p>
   <p>
-    <label>Port 1</label><br>
-    <input type="number" name="Port1" value="456">
+    <label>IPv6 Address (optional)</label><br>
+    <input type="text" name="Addr6">
   </p>
   <p>
-    <label>Public IP 2 (optional)</label><br>
-    <input type="text" name="PublicIP2">
-  </p>
-  <p>
-    <label>Port 2</label><br>
-    <input type="number" name="Port2" value="0">
+    <label>WireGuard Port</label><br>
+    <input type="number" name="Port" value="51820">
   </p>
   <p>
     <label>
diff --git a/hub/templates/network/peer-edit.html b/hub/templates/network/peer-edit.html
index 5953790..4fd89a8 100644
--- a/hub/templates/network/peer-edit.html
+++ b/hub/templates/network/peer-edit.html
@@ -12,20 +12,16 @@
     <input type="text" name="Name" value="{{.Name}}">
   </p>
   <p>
-    <label>Public IP 1</label><br>
-    <input type="text" name="PublicIP1" value="{{ipToString .PublicIP1}}">
+    <label>IPv4 Address (optional)</label><br>
+    <input type="text" name="Addr4" value="{{ipToString .Addr4}}">
   </p>
   <p>
-    <label>Port 1</label><br>
-    <input type="number" name="Port1" value="{{.Port1}}">
+    <label>IPv6 Address (optional)</label><br>
+    <input type="text" name="Addr6" value="{{ipToString .Addr6}}">
   </p>
   <p>
-    <label>Public IP 2 (optional)</label><br>
-    <input type="text" name="PublicIP2" value="{{ipToString .PublicIP2}}">
-  </p>
-  <p>
-    <label>Port 2</label><br>
-    <input type="number" name="Port2" value="{{.Port2}}">
+    <label>WireGuard Port</label><br>
+    <input type="number" name="Port" value="{{.Port}}">
   </p>
   <p>
     <label>
diff --git a/hub/templates/network/peer-view.html b/hub/templates/network/peer-view.html
index 415186c..3d41b02 100644
--- a/hub/templates/network/peer-view.html
+++ b/hub/templates/network/peer-view.html
@@ -8,10 +8,9 @@
 {{with .Peer -}}
 <table class="def-list">
   <tr><td>Peer IP</td><td>{{.PeerIP}}</td></tr>
-  <tr><td>Public IP 1</td><td>{{ipToString .PublicIP1}}</td></tr>
-  <tr><td>Port 1</td><td>{{.Port1}}</td></tr>
-  <tr><td>Public IP 2</td><td>{{ipToString .PublicIP2}}</td></tr>
-  <tr><td>Port 2</td><td>{{.Port2}}</td></tr>
+  <tr><td>IPv4 Address</td><td>{{ipToString .Addr4}}</td></tr>
+  <tr><td>IPv6 Address</td><td>{{ipToString .Addr6}}</td></tr>
+  <tr><td>WireGuard Port</td><td>{{.Port}}</td></tr>
   <tr><td>Relay</td><td>{{if .Relay}}T{{else}}F{{end}}</td></tr>
   <tr><td>WG Public Key</td><td>{{wgKeyString .WGPubKey}}</td></tr>
 </table>
diff --git a/peer/files.go b/peer/files.go
deleted file mode 100644
index 4d1d5c9..0000000
--- a/peer/files.go
+++ /dev/null
@@ -1,98 +0,0 @@
-//go:build ignore
-
-package peer
-
-import (
-	"encoding/json"
-	"log"
-	"os"
-	"path/filepath"
-	"vppn/m"
-)
-
-type LocalConfig struct {
-	LocalPeerIP byte
-	Network     []byte
-	WGPrivKey   string
-}
-
-func configDir(netName string) string {
-	d, err := os.UserHomeDir()
-	if err != nil {
-		log.Fatalf("Failed to get user home directory: %v", err)
-	}
-	return filepath.Join(d, ".vppn", netName)
-}
-
-func lockFilePath(netName string) string {
-	return filepath.Join(configDir(netName), "__lock__")
-}
-
-func peerConfigPath(netName string) string {
-	return filepath.Join(configDir(netName), "config.json")
-}
-
-func peerStatePath(netName string) string {
-	return filepath.Join(configDir(netName), "state.json")
-}
-
-func statusSocketPath(netName string) string {
-	return filepath.Join(configDir(netName), "status.sock")
-}
-
-func storeJson(x any, outPath string) error {
-	outDir := filepath.Dir(outPath)
-	_ = os.MkdirAll(outDir, 0700)
-
-	tmpPath := outPath + ".tmp"
-	buf, err := json.Marshal(x)
-	if err != nil {
-		return err
-	}
-
-	f, err := os.OpenFile(tmpPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
-	if err != nil {
-		return err
-	}
-
-	if _, err := f.Write(buf); err != nil {
-		f.Close()
-		return err
-	}
-
-	if err := f.Sync(); err != nil {
-		f.Close()
-		return err
-	}
-
-	if err := f.Close(); err != nil {
-		return err
-	}
-
-	return os.Rename(tmpPath, outPath)
-}
-
-func storePeerConfig(netName string, pc LocalConfig) error {
-	return storeJson(pc, peerConfigPath(netName))
-}
-
-func storeNetworkState(netName string, ps m.NetworkState) error {
-	return storeJson(ps, peerStatePath(netName))
-}
-
-func loadJson(dataPath string, ptr any) error {
-	data, err := os.ReadFile(dataPath)
-	if err != nil {
-		return err
-	}
-
-	return json.Unmarshal(data, ptr)
-}
-
-func loadPeerConfig(netName string) (pc LocalConfig, err error) {
-	return pc, loadJson(peerConfigPath(netName), &pc)
-}
-
-func loadNetworkState(netName string) (ps m.NetworkState, err error) {
-	return ps, loadJson(peerStatePath(netName), &ps)
-}
diff --git a/peer/globals.go b/peer/globals.go
deleted file mode 100644
index edf6dea..0000000
--- a/peer/globals.go
+++ /dev/null
@@ -1,41 +0,0 @@
-//go:build ignore
-
-package peer
-
-import (
-	"net"
-	"net/netip"
-	"time"
-
-	"golang.zx2c4.com/wireguard/wgctrl"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-const (
-	broadcastInterval             = 16 * time.Second
-	broadcastErrorTimeoutInterval = 8 * time.Second
-)
-
-var multicastAddr = net.UDPAddrFromAddrPort(netip.AddrPortFrom(
-	netip.AddrFrom4([4]byte{224, 0, 0, 157}),
-	4560))
-
-type Globals struct {
-	LocalConfig // Embed, immutable.
-
-	// WireGuard private key, client, and device name. Immutable after init.
-	WGPrivKey wgtypes.Key
-	WGClient  *wgctrl.Client
-	WGDevName string
-
-	// Local public address (if available). Immutable.
-	LocalAddr      netip.AddrPort
-	LocalAddrValid bool
-}
-
-func NewGlobals(localConfig LocalConfig, localAddr netip.AddrPort) (g Globals) {
-	g.LocalConfig = localConfig
-	g.LocalAddr = localAddr
-	g.LocalAddrValid = localAddr.IsValid()
-	return g
-}
diff --git a/peer/holepunch.go b/peer/holepunch.go
deleted file mode 100644
index c2565e6..0000000
--- a/peer/holepunch.go
+++ /dev/null
@@ -1,157 +0,0 @@
-//go:build ignore
-
-package peer
-
-import (
-	"log"
-	"net/netip"
-	"sync"
-	"time"
-
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-const (
-	probeWait    = 15 * time.Second
-	backoffStart = 5 * time.Minute
-	backoffMax   = time.Hour
-)
-
-type probeState struct {
-	pubKey    wgtypes.Key
-	endpoint  netip.AddrPort
-	probing   bool
-	direct    bool
-	backoff   time.Duration
-	backoffAt time.Time
-}
-
-type HolePunch struct {
-	Globals
-	mu    sync.Mutex
-	peers [256]*probeState
-}
-
-func NewHolePunch(g Globals) *HolePunch {
-	return &HolePunch{Globals: g}
-}
-
-// OnEndpointLearned is called when a peer's external WG endpoint becomes known,
-// either from the VPN control channel (MsgMyEndpoint) or from the hub poller.
-// fromHub=true resets any existing backoff so the hub-reported change is acted
-// on immediately.
-func (hp *HolePunch) OnEndpointLearned(peerIP byte, pubKey wgtypes.Key, endpoint netip.AddrPort, fromHub bool) {
-	hp.mu.Lock()
-	defer hp.mu.Unlock()
-
-	ps := hp.peers[peerIP]
-	if ps == nil {
-		ps = &probeState{pubKey: pubKey}
-		hp.peers[peerIP] = ps
-	}
-
-	if fromHub {
-		ps.backoff = 0
-		ps.backoffAt = time.Time{}
-		ps.direct = false
-		ps.pubKey = pubKey
-	}
-	ps.endpoint = endpoint
-
-	if ps.probing || ps.direct {
-		return
-	}
-	if ps.backoff > 0 && time.Now().Before(ps.backoffAt) {
-		return
-	}
-
-	ps.probing = true
-	go hp.runProbe(peerIP)
-}
-
-func (hp *HolePunch) runProbe(peerIP byte) {
-	hp.mu.Lock()
-	ps := hp.peers[peerIP]
-	if ps == nil {
-		hp.mu.Unlock()
-		return
-	}
-	pubKey := ps.pubKey
-	endpoint := ps.endpoint
-	hp.mu.Unlock()
-
-	vpnIP := netip.AddrFrom4([4]byte{
-		hp.Network[0], hp.Network[1], hp.Network[2], peerIP,
-	})
-
-	probeStart := time.Now()
-	if err := addProbeEntry(hp.WGClient, hp.WGDevName, pubKey, endpoint); err != nil {
-		log.Printf("[HolePunch] addProbeEntry peer %d: %v", peerIP, err)
-		hp.finishProbe(peerIP, false)
-		return
-	}
-
-	time.Sleep(probeWait)
-
-	_, handshakeTime, err := getPeerEndpoint(hp.WGClient, hp.WGDevName, pubKey)
-	if err == nil && handshakeTime.After(probeStart) {
-		if err := promoteToDirect(hp.WGClient, hp.WGDevName, pubKey, vpnIP); err != nil {
-			log.Printf("[HolePunch] promoteToDirect peer %d: %v", peerIP, err)
-		}
-		hp.finishProbe(peerIP, true)
-		return
-	}
-
-	// Probe failed — remove entry and schedule backoff retry.
-	if err := removePeerEntry(hp.WGClient, hp.WGDevName, pubKey); err != nil {
-		log.Printf("[HolePunch] removePeerEntry peer %d: %v", peerIP, err)
-	}
-
-	hp.mu.Lock()
-	ps = hp.peers[peerIP]
-	var delay time.Duration
-	if ps != nil {
-		if ps.backoff == 0 {
-			ps.backoff = backoffStart
-		} else {
-			ps.backoff = min(ps.backoff*2, backoffMax)
-		}
-		ps.backoffAt = time.Now().Add(ps.backoff)
-		ps.probing = false
-		delay = ps.backoff
-	}
-	hp.mu.Unlock()
-
-	if delay > 0 {
-		go func() {
-			time.Sleep(delay)
-			hp.retryProbe(peerIP)
-		}()
-	}
-}
-
-func (hp *HolePunch) finishProbe(peerIP byte, success bool) {
-	hp.mu.Lock()
-	defer hp.mu.Unlock()
-	ps := hp.peers[peerIP]
-	if ps == nil {
-		return
-	}
-	ps.probing = false
-	if success {
-		ps.direct = true
-		ps.backoff = 0
-	}
-}
-
-func (hp *HolePunch) retryProbe(peerIP byte) {
-	hp.mu.Lock()
-	ps := hp.peers[peerIP]
-	if ps == nil || ps.probing || ps.direct {
-		hp.mu.Unlock()
-		return
-	}
-	ps.probing = true
-	hp.mu.Unlock()
-	hp.runProbe(peerIP)
-}
diff --git a/peer/hubpoller.go b/peer/hubpoller.go
deleted file mode 100644
index 08aeb46..0000000
--- a/peer/hubpoller.go
+++ /dev/null
@@ -1,146 +0,0 @@
-//go:build ignore
-
-package peer
-
-import (
-	"encoding/json"
-	"io"
-	"log"
-	"net/http"
-	"net/netip"
-	"net/url"
-	"time"
-	"vppn/m"
-
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-type HubPoller struct {
-	client   *http.Client
-	req      *http.Request
-	versions [256]int64
-	netName  string
-}
-
-func NewHubPoller(
-	netName,
-	hubURL,
-	apiKey string,
-) (*HubPoller, error) {
-	u, err := url.Parse(hubURL)
-	if err != nil {
-		return nil, err
-	}
-	u.Path = "/peer/fetch-state/"
-
-	client := &http.Client{Timeout: 8 * time.Second}
-
-	req := &http.Request{
-		Method: http.MethodGet,
-		URL:    u,
-		Header: http.Header{},
-	}
-	req.SetBasicAuth("", apiKey)
-
-	return &HubPoller{
-		Globals:   g,
-		holePunch: hp,
-		client:    client,
-		req:       req,
-		netName:   netName,
-	}, nil
-}
-
-func (hp *HubPoller) logf(s string, args ...any) {
-	log.Printf("[HubPoller] "+s, args...)
-}
-
-func (hp *HubPoller) Run() {
-	state, err := loadNetworkState(hp.netName)
-	if err != nil {
-		hp.logf("Failed to load network state: %v", err)
-		hp.logf("Polling hub...")
-		hp.pollHub()
-	} else {
-		hp.applyNetworkState(state)
-	}
-
-	for range time.Tick(64 * time.Second) {
-		hp.pollHub()
-	}
-}
-
-func (hp *HubPoller) pollHub() {
-	var state m.NetworkState
-
-	resp, err := hp.client.Do(hp.req)
-	if err != nil {
-		hp.logf("Failed to fetch peer state: %v", err)
-		return
-	}
-	body, err := io.ReadAll(resp.Body)
-	_ = resp.Body.Close()
-	if err != nil {
-		hp.logf("Failed to read body from hub: %v", err)
-		return
-	}
-
-	if err := json.Unmarshal(body, &state); err != nil {
-		hp.logf("Failed to unmarshal response from hub: %v\n%s", err, body)
-		return
-	}
-
-	if err := storeNetworkState(hp.netName, state); err != nil {
-		hp.logf("Failed to store network state: %v", err)
-	}
-
-	hp.applyNetworkState(state)
-}
-
-func (hp *HubPoller) applyNetworkState(state m.NetworkState) {
-	for i, peer := range state.Peers {
-		if i == int(hp.LocalPeerIP) {
-			continue
-		}
-		if peer != nil && peer.Version == hp.versions[i] {
-			continue
-		}
-		hp.applyPeerConfig(peer)
-		if peer != nil {
-			hp.versions[i] = peer.Version
-		}
-	}
-}
-
-func (hp *HubPoller) applyPeerConfig(peer *m.Peer) {
-	if peer == nil || len(peer.WGPubKey) != wgtypes.KeyLen {
-		return
-	}
-	if len(peer.Addr4) == 0 || peer.Port == 0 {
-		return
-	}
-
-	pubKey, err := wgtypes.NewKey(peer.WGPubKey)
-	if err != nil {
-		hp.logf("Invalid WG key for peer %d: %v", peer.PeerIP, err)
-		return
-	}
-
-	ip, ok := netip.AddrFromSlice(peer.Addr4)
-	if !ok {
-		hp.logf("Invalid public IP for peer %d", peer.PeerIP)
-		return
-	}
-	endpoint := netip.AddrPortFrom(ip.Unmap(), peer.Port)
-
-	if peer.Relay {
-		if err := applyBaseConfig(hp.WGClient, hp.WGDevName, pubKey, endpoint, hp.Network); err != nil {
-			hp.logf("Failed to update relay config: %v", err)
-		}
-		return
-	}
-
-	if hp.holePunch != nil {
-		hp.holePunch.OnEndpointLearned(peer.PeerIP, pubKey, endpoint, true)
-	}
-}
diff --git a/peer/mcreader.go b/peer/mcreader.go
deleted file mode 100644
index 42c51bb..0000000
--- a/peer/mcreader.go
+++ /dev/null
@@ -1,68 +0,0 @@
-//go:build ignore
-
-package peer
-
-import (
-	"encoding/binary"
-	"fmt"
-	"log"
-	"net"
-	"net/netip"
-	"time"
-
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-func RunMCReader(g Globals, hp *HolePunch, netName string) {
-	for {
-		if err := runMCReaderInner(g, hp, netName); err != nil {
-			log.Printf("[MCReader] %v", err)
-		}
-		time.Sleep(broadcastErrorTimeoutInterval)
-	}
-}
-
-func runMCReaderInner(g Globals, hp *HolePunch, netName string) error {
-	conn, err := net.ListenMulticastUDP("udp", nil, multicastAddr)
-	if err != nil {
-		return fmt.Errorf("bind: %w", err)
-	}
-	defer conn.Close()
-
-	buf := make([]byte, 64)
-	for {
-		conn.SetReadDeadline(time.Now().Add(32 * time.Second))
-		n, src, err := conn.ReadFromUDPAddrPort(buf)
-		if err != nil {
-			return fmt.Errorf("read: %w", err)
-		}
-		if n != beaconLen {
-			continue
-		}
-		handleBeacon(g, hp, netName, buf[:n], src)
-	}
-}
-
-func handleBeacon(g Globals, hp *HolePunch, netName string, beacon []byte, src netip.AddrPort) {
-	peerIPByte := beacon[0]
-	if peerIPByte == g.LocalPeerIP {
-		return
-	}
-
-	pubKey, err := wgtypes.NewKey(beacon[1:33])
-	if err != nil {
-		return
-	}
-
-	// Skip relay peers: probing would replace their /24 AllowedIPs with empty.
-	if state, err := loadNetworkState(netName); err == nil {
-		if p := state.Peers[peerIPByte]; p != nil && p.Relay {
-			return
-		}
-	}
-
-	wgPort := binary.BigEndian.Uint16(beacon[33:35])
-	endpoint := netip.AddrPortFrom(src.Addr().Unmap(), wgPort)
-
-	hp.OnEndpointLearned(peerIPByte, pubKey, endpoint, false)
-}
diff --git a/peer/mcwriter.go b/peer/mcwriter.go
deleted file mode 100644
index 642240b..0000000
--- a/peer/mcwriter.go
+++ /dev/null
@@ -1,45 +0,0 @@
-//go:build ignore
-
-package peer
-
-import (
-	"encoding/binary"
-	"fmt"
-	"log"
-	"net"
-	"time"
-)
-
-const beaconLen = 35 // 1 VPN IP byte + 32 WG pubkey + 2 WG listen port
-
-func RunMCWriter(g Globals) {
-	conn, err := net.ListenMulticastUDP("udp", nil, multicastAddr)
-	if err != nil {
-		log.Fatalf("[MCWriter] bind: %v", err)
-	}
-
-	for range time.Tick(broadcastInterval) {
-		beacon, err := buildBeacon(g)
-		if err != nil {
-			log.Printf("[MCWriter] build beacon: %v", err)
-			continue
-		}
-		log.Printf("[MCWriter] Broadcasting on %v...", multicastAddr)
-		if _, err := conn.WriteToUDP(beacon, multicastAddr); err != nil {
-			log.Printf("[MCWriter] write: %v", err)
-		}
-	}
-}
-
-func buildBeacon(g Globals) ([]byte, error) {
-	dev, err := g.WGClient.Device(g.WGDevName)
-	if err != nil {
-		return nil, fmt.Errorf("get WG device: %w", err)
-	}
-	beacon := make([]byte, beaconLen)
-	beacon[0] = g.LocalPeerIP
-	pubKey := g.WGPrivKey.PublicKey()
-	copy(beacon[1:33], pubKey[:])
-	binary.BigEndian.PutUint16(beacon[33:35], uint16(dev.ListenPort))
-	return beacon, nil
-}
diff --git a/peer/wgdev.go b/peer/wgdev.go
deleted file mode 100644
index 395b9c8..0000000
--- a/peer/wgdev.go
+++ /dev/null
@@ -1,179 +0,0 @@
-//go:build ignore
-
-package peer
-
-import (
-	"fmt"
-	"net"
-	"net/netip"
-	"os"
-	"time"
-
-	"github.com/vishvananda/netlink"
-	"golang.zx2c4.com/wireguard/wgctrl"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-func createWGDevice(name string, privKey wgtypes.Key, listenPort int, vpnIP netip.Addr, network []byte) (*wgctrl.Client, error) {
-	if len(network) != 4 {
-		return nil, fmt.Errorf("expected 4-byte network, got %d", len(network))
-	}
-
-	la := netlink.NewLinkAttrs()
-	la.Name = name
-	if err := netlink.LinkAdd(&netlink.GenericLink{LinkAttrs: la, LinkType: "wireguard"}); err != nil {
-		return nil, fmt.Errorf("add wireguard link: %w", err)
-	}
-
-	link, err := netlink.LinkByName(name)
-	if err != nil {
-		_ = destroyWGDevice(name)
-		return nil, fmt.Errorf("get wireguard link: %w", err)
-	}
-
-	a4 := vpnIP.As4()
-	if err := netlink.AddrAdd(link, &netlink.Addr{
-		IPNet: &net.IPNet{
-			IP:   net.IP(a4[:]),
-			Mask: net.CIDRMask(24, 32),
-		},
-	}); err != nil {
-		_ = destroyWGDevice(name)
-		return nil, fmt.Errorf("add VPN address: %w", err)
-	}
-
-	if err := netlink.LinkSetUp(link); err != nil {
-		_ = destroyWGDevice(name)
-		return nil, fmt.Errorf("set link up: %w", err)
-	}
-
-	client, err := wgctrl.New()
-	if err != nil {
-		_ = destroyWGDevice(name)
-		return nil, fmt.Errorf("new wgctrl client: %w", err)
-	}
-
-	cfg := wgtypes.Config{
-		PrivateKey: &privKey,
-		ListenPort: &listenPort,
-	}
-	if err := client.ConfigureDevice(name, cfg); err != nil {
-		client.Close()
-		_ = destroyWGDevice(name)
-		return nil, fmt.Errorf("configure wireguard: %w", err)
-	}
-
-	return client, nil
-}
-
-func destroyWGDevice(name string) error {
-	link, err := netlink.LinkByName(name)
-	if err != nil {
-		return fmt.Errorf("get link %q: %w", name, err)
-	}
-	return netlink.LinkDel(link)
-}
-
-// applyBaseConfig adds the relay peer with /24 AllowedIPs, making it the
-// fallback route for all VPN traffic.
-func applyBaseConfig(client *wgctrl.Client, devName string, relayPubKey wgtypes.Key, relayEndpoint netip.AddrPort, network []byte) error {
-	if len(network) != 4 {
-		return fmt.Errorf("expected 4-byte network, got %d", len(network))
-	}
-	keepalive := 25 * time.Second
-	cfg := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{{
-			PublicKey: relayPubKey,
-			Endpoint:  net.UDPAddrFromAddrPort(relayEndpoint),
-			AllowedIPs: []net.IPNet{{
-				IP:   net.IP{network[0], network[1], network[2], 0},
-				Mask: net.CIDRMask(24, 32),
-			}},
-			ReplaceAllowedIPs:           true,
-			PersistentKeepaliveInterval: &keepalive,
-		}},
-	}
-	return client.ConfigureDevice(devName, cfg)
-}
-
-// addProbeEntry adds a peer with no AllowedIPs and a 5s keepalive so WireGuard
-// attempts handshakes without routing any traffic through it yet.
-func addProbeEntry(client *wgctrl.Client, devName string, pubKey wgtypes.Key, endpoint netip.AddrPort) error {
-	keepalive := 5 * time.Second
-	cfg := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{{
-			PublicKey:                   pubKey,
-			Endpoint:                    net.UDPAddrFromAddrPort(endpoint),
-			AllowedIPs:                  []net.IPNet{},
-			ReplaceAllowedIPs:           true,
-			PersistentKeepaliveInterval: &keepalive,
-		}},
-	}
-	return client.ConfigureDevice(devName, cfg)
-}
-
-// addDirectPeer adds a peer with a known endpoint and /32 AllowedIPs in one
-// step, for use when the hub reports a peer with a stable public endpoint.
-func addDirectPeer(client *wgctrl.Client, devName string, pubKey wgtypes.Key, endpoint netip.AddrPort, vpnIP netip.Addr) error {
-	a4 := vpnIP.As4()
-	cfg := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{{
-			PublicKey: pubKey,
-			Endpoint:  net.UDPAddrFromAddrPort(endpoint),
-			AllowedIPs: []net.IPNet{{
-				IP:   net.IP(a4[:]),
-				Mask: net.CIDRMask(32, 32),
-			}},
-			ReplaceAllowedIPs: true,
-		}},
-	}
-	return client.ConfigureDevice(devName, cfg)
-}
-
-// promoteToDirect upgrades a probe entry to a /32 AllowedIPs entry, causing
-// WireGuard to prefer the direct path over the relay's /24 route.
-func promoteToDirect(client *wgctrl.Client, devName string, pubKey wgtypes.Key, vpnIP netip.Addr) error {
-	a4 := vpnIP.As4()
-	cfg := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{{
-			PublicKey: pubKey,
-			AllowedIPs: []net.IPNet{{
-				IP:   net.IP(a4[:]),
-				Mask: net.CIDRMask(32, 32),
-			}},
-			ReplaceAllowedIPs: true,
-		}},
-	}
-	return client.ConfigureDevice(devName, cfg)
-}
-
-func removePeerEntry(client *wgctrl.Client, devName string, pubKey wgtypes.Key) error {
-	cfg := wgtypes.Config{
-		Peers: []wgtypes.PeerConfig{{
-			PublicKey: pubKey,
-			Remove:    true,
-		}},
-	}
-	return client.ConfigureDevice(devName, cfg)
-}
-
-func enableForwarding(ifaceName string) error {
-	path := fmt.Sprintf("/proc/sys/net/ipv4/conf/%s/forwarding", ifaceName)
-	return os.WriteFile(path, []byte("1\n"), 0644)
-}
-
-func getPeerEndpoint(client *wgctrl.Client, devName string, pubKey wgtypes.Key) (netip.AddrPort, time.Time, error) {
-	dev, err := client.Device(devName)
-	if err != nil {
-		return netip.AddrPort{}, time.Time{}, fmt.Errorf("get device: %w", err)
-	}
-	for _, p := range dev.Peers {
-		if p.PublicKey == pubKey {
-			if p.Endpoint == nil {
-				return netip.AddrPort{}, p.LastHandshakeTime, nil
-			}
-			return p.Endpoint.AddrPort(), p.LastHandshakeTime, nil
-		}
-	}
-	return netip.AddrPort{}, time.Time{}, fmt.Errorf("peer %v not found in device %s", pubKey, devName)
-}