From 8bf30b345b2292139071b4901c0ccbad136331eb Mon Sep 17 00:00:00 2001
From: jdl <jdl@desktop>
Date: Tue, 9 Jun 2026 20:36:30 +0200
Subject: [PATCH] Some bug fixes, working better.

---
 peer/on_hub.go  | 9 ++++++++-
 peer/on_tick.go | 4 +++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/peer/on_hub.go b/peer/on_hub.go
index be66b89..59ba67e 100644
--- a/peer/on_hub.go
+++ b/peer/on_hub.go
@@ -37,7 +37,14 @@ func (a *App) onAddPeer(p HubPeer) {
 	a.peersByIP[peer.VPNIP] = peer
 
 	if !peer.IsPublic {
-		a.devAddPeer(peer)
+		if a.isPublic {
+			// Public nodes accept traffic from non-public peers as soon as they
+			// initiate a handshake. Set /32 AllowedIPs now; WireGuard learns the
+			// endpoint from the incoming handshake automatically.
+			a.devPromote(peer)
+		} else {
+			a.devAddPeer(peer)
+		}
 		return
 	}
 
diff --git a/peer/on_tick.go b/peer/on_tick.go
index c258cb0..a9aedda 100644
--- a/peer/on_tick.go
+++ b/peer/on_tick.go
@@ -37,7 +37,9 @@ func (a *App) onTick() {
 
 		case StateDirect:
 			// Demote stale non-public direct peers back to probing.
-			if !p.IsPublic && !p.Up() {
+			// Public nodes skip this: the non-public peer will re-initiate the
+			// handshake, and WireGuard will update the endpoint automatically.
+			if !p.IsPublic && !p.Up() && !a.isPublic {
 				a.devAddProbe(p, p.WGEndpoint())
 			}
 		}