Renew hosts with direct WireGuard routes first and public URLs as fallbacks

scripts/renew-hosts.sh

@@ -13,15 +13,17 @@ GATEWAY_SSH="${GATEWAY_SSH:-junior.gib}"
 GATEWAY_RUNTIME="${GATEWAY_RUNTIME:-podman}"
 GATEWAY_CONTAINER="${GATEWAY_CONTAINER:-wristcode-gateway}"
 
-# label | SSH host, or "local" for the machine running this script | public T3 URLs
-# A host can list several URLs, space separated, preferred first. The gateway falls back to the
-# next one when a route does not answer, such as the laptop's VPN route when it is away from home.
+# label | SSH host, or "local" for the machine running this script | T3 URLs
+# URLs are space separated, preferred first. The gateway uses the first one that answers. Direct
+# routes come first: from junior they cross WireGuard straight to the machine, so they skip
+# Cloudflare and the home server's tunnel and proxy. The public URLs are the fallback. LittleMan is
+# junior itself, reached at its own WireGuard address.
 HOSTS=(
-  "Desktop|local|https://t3desktop.gbrown.org"
-  "Mac mini|mac.gib|https://t3mac.gbrown.org"
-  "server-gib|server.gib|https://t3sr.gbrown.org"
-  "LittleMan|junior.gib|https://t3jr.gbrown.org"
-  "Laptop|laptop.gib|https://t3laptop.gbrown.org https://t3laptopvpn.gbrown.org"
+  "Desktop|local|http://desktop.gib:3773 https://t3desktop.gbrown.org"
+  "Mac mini|mac.gib|http://mac.gib:3773 https://t3mac.gbrown.org"
+  "server-gib|server.gib|http://server.gib:3773 https://t3sr.gbrown.org"
+  "LittleMan|junior.gib|http://192.168.2.2:3773 https://t3jr.gbrown.org"
+  "Laptop|laptop.gib|http://laptop.gib:3773 http://laptopvpn.gib:3773 https://t3laptop.gbrown.org https://t3laptopvpn.gbrown.org"
 )
 
 # Prints a pairing credential. Runs on the T3 host. The CLI is not on PATH in non-login shells,