Some bug fixes, working better.

peer/on_hub.go

@@ -37,7 +37,14 @@ func (a *App) onAddPeer(p HubPeer) {
 	a.peersByIP[peer.VPNIP] = peer
 
 	if !peer.IsPublic {
-		a.devAddPeer(peer)
+		if a.isPublic {
+			// Public nodes accept traffic from non-public peers as soon as they
+			// initiate a handshake. Set /32 AllowedIPs now; WireGuard learns the
+			// endpoint from the incoming handshake automatically.
+			a.devPromote(peer)
+		} else {
+			a.devAddPeer(peer)
+		}
 		return
 	}