gib/wristcode
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Renew hosts with direct WireGuard routes first and public URLs as fallbacks

Browse Source
This commit is contained in:
gib committed 2026-11-01 13:25:39 -05:00
1 parent 42b6a4920c
commit 277683d5ee
2 files changed
+13 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

README.md
+3 -3
View File
@@ -37,9 +37,9 @@ Operators use the `wristcode` CLI inside the container, on junior.gib:
t3 auth pairing create --scope orchestration:read --scope orchestration:operate --label "WristCode gateway"
podman exec -it wristcode-gateway wristcode host add https://t3mac.gbrown.org <credential> --label "Mac mini"
# A host reachable more than one way, such as a laptop with a VPN route, lists fallbacks.
# The gateway tries them in order when the first does not answer.
podman exec -it wristcode-gateway wristcode host add https://t3laptop.gbrown.org <credential> --label "Laptop" --alt-url https://t3laptopvpn.gbrown.org
# A host reachable more than one way lists fallbacks, preferred first. The gateway uses the
# first route that answers: here a direct WireGuard address, then the public URL.
podman exec -it wristcode-gateway wristcode host add http://desktop.gib:3773 <credential> --label "Desktop" --alt-url https://t3desktop.gbrown.org
# Pair a watch: enter the printed code on the watch within 5 minutes.
podman exec -it wristcode-gateway wristcode pair
scripts/renew-hosts.sh
+10 -8
View File
@@ -13,15 +13,17 @@ GATEWAY_SSH="${GATEWAY_SSH:-junior.gib}"
GATEWAY_RUNTIME="${GATEWAY_RUNTIME:-podman}"
GATEWAY_CONTAINER="${GATEWAY_CONTAINER:-wristcode-gateway}"
# label | SSH host, or "local" for the machine running this script | public T3 URLs
# A host can list several URLs, space separated, preferred first. The gateway falls back to the
# next one when a route does not answer, such as the laptop's VPN route when it is away from home.
# label | SSH host, or "local" for the machine running this script | T3 URLs
# URLs are space separated, preferred first. The gateway uses the first one that answers. Direct
# routes come first: from junior they cross WireGuard straight to the machine, so they skip
# Cloudflare and the home server's tunnel and proxy. The public URLs are the fallback. LittleMan is
# junior itself, reached at its own WireGuard address.
HOSTS=(
"Desktop|local|https://t3desktop.gbrown.org"
"Mac mini|mac.gib|https://t3mac.gbrown.org"
"server-gib|server.gib|https://t3sr.gbrown.org"
"LittleMan|junior.gib|https://t3jr.gbrown.org"
"Laptop|laptop.gib|https://t3laptop.gbrown.org https://t3laptopvpn.gbrown.org"
"Desktop|local|http://desktop.gib:3773 https://t3desktop.gbrown.org"
"Mac mini|mac.gib|http://mac.gib:3773 https://t3mac.gbrown.org"
"server-gib|server.gib|http://server.gib:3773 https://t3sr.gbrown.org"
"LittleMan|junior.gib|http://192.168.2.2:3773 https://t3jr.gbrown.org"
"Laptop|laptop.gib|http://laptop.gib:3773 http://laptopvpn.gib:3773 https://t3laptop.gbrown.org https://t3laptopvpn.gbrown.org"
)
# Prints a pairing credential. Runs on the T3 host. The CLI is not on PATH in non-login shells,