Wave 9 #122.d.i — Phase 6 Tailscale wizard Path D (Wireguard) wired

connections/remote-access/connection.yml

@@ -414,22 +414,30 @@ wizard:
         Coming soon — Path A is wired now.
 
     - id: wireguard
-      label: "Wireguard (coming soon)"
+      label: "Wireguard (self-hosted VPN)"
       connection_kind: recipe
       tier: b
       recipe_over: "HACS `wireguard` add-on + manual per-client key management"
       estimated_time: "~45 min"
       requires_reboot: false
       requires_inputs:
-        - "Wireguard server keys"
-        - "Per-client Wireguard keys"
-        - "Firewall access to UDP 51820"
+        - "Wireguard server endpoint (public hostname or IP)"
+        - "Wireguard server public key"
+        - "Wireguard peer (client) private key"
+        - "Wireguard peer allowed IPs (e.g. 10.0.0.2/32)"
       side_effects:
         - registers_wizard_helpers_input_selects
         - registers_wizard_helpers_input_texts
-        - routes_to_wireguard_stub_stage
+        - registers_wizard_template_binary_sensors
+        - registers_wizard_template_sensor_status
+        - registers_wizard_advance_automation
+        - registers_wizard_recovery_automation
+        - registers_wizard_detect_existing_automation
+        - registers_wizard_path_pick_routing_automation
+        - advances_setup_wizard_stage_to_map_on_completion
       setup_notes: |
-        Coming soon — Path A is wired now.
+        Pick this if you already run your own Wireguard VPN — the wizard
+        walks you through it in four plain-English taps.
 
     - id: skip
       label: "Skip remote access"

docs/setup/guided-remote-access.md

@@ -1,7 +1,21 @@
 # Checking your van from anywhere
 
-This guide walks you through setting up Tailscale so you can check
-on your van from your phone, even when you're far away from it.
+This guide walks you through setting up a remote-access path so you
+can check on your van from your phone, even when you're far away
+from it. RoamCore supports four remote-access paths; pick the one
+that fits your life.
+
+- **Path A — Tailscale** (free mesh VPN, recommended for most
+  operators). Full step-by-step in §3 below.
+- **Path B — Cloudflare Tunnel** (free, no inbound ports). Coming
+  soon.
+- **Path C — Nabu Casa HA Cloud** (paid; for operators who already
+  subscribe). Coming soon.
+- **Path D — Wireguard** (self-hosted VPN for technical operators).
+  Step-by-step in §6 below.
+
+If you'd rather not set up remote access at all, pick **Skip** from
+the wizard's path drop-down.
 
 ## 1. What this is
 
@@ -102,3 +116,109 @@ won't lose anything.
 You can come back to this card any time to see where you are in the
 setup, change your settings, or turn remote access off if you ever
 want to.
+
+## 6. How to set up Wireguard (Path D — self-hosted VPN)
+
+Pick this path if you already run your own Wireguard VPN — for
+example, a small server at home, or a VPS you pay for. Wireguard
+is fast, has no per-account limits, and you keep full control of
+the tunnel.
+
+### 6.1 What this is
+
+Wireguard is a small piece of VPN software that lets your phone
+and your van talk to each other safely over the internet. Unlike
+Tailscale or Nabu Casa, there's no company in the middle — you
+own the Wireguard server, you create the keys, and the tunnel is
+entirely yours. Once it's set up, you can open your RoamCore
+dashboard from anywhere on the internet, just like the other
+paths.
+
+### 6.2 What you see
+
+When you open the **Remote access setup** card on your dashboard
+and pick **Wireguard (self-hosted VPN)** from the drop-down,
+you'll see:
+
+- One sentence at the top in plain English. It tells you what's
+  happening right now. For example: "Do you already run your own
+  Wireguard VPN?" or "Testing your Wireguard connection..." or
+  "Wireguard is set up. You're good to go."
+- One question — "Do you already run your own Wireguard VPN?"
+  — which the dashboard answers for you once the wizard detects
+  a working Wireguard interface.
+- Four boxes to paste your Wireguard details: server endpoint,
+  server public key, peer private key, and peer allowed IPs. The
+  boxes hide what you type so no one looking over your shoulder
+  can see them.
+
+That's it. You don't need to type any commands, edit any files, or
+restart anything yourself.
+
+### 6.3 What you do
+
+Follow these four steps, in order. Stop when you're done — the
+dashboard will tell you when each step is finished.
+
+1. **Install the Wireguard add-on in Home Assistant.** Open Home
+   Assistant on your phone or laptop, go to **Settings → Add-ons →
+   Add-on store**, search for **Wireguard**, and install it. Wait
+   until it says the add-on is running.
+2. **Pick Wireguard.** On the Remote access setup card, change
+   the drop-down to **Wireguard (self-hosted VPN)**.
+3. **Paste your Wireguard server details.** Fill in the four boxes:
+   your Wireguard server endpoint (something like
+   `wg.example.com:51820`), your server's public key, the peer
+   (client) private key for your phone, and the peer allowed IPs
+   (usually `10.0.0.2/32`). The boxes hide what you type so no one
+   looking over your shoulder can see them.
+4. **Wait for the dashboard to say it's done.** The sentence at
+   the top will change from "Testing your Wireguard connection..."
+   to "Wireguard is set up. You're good to go." That usually takes
+   under a minute. When it does, open your phone's Wireguard app
+   and flip the tunnel on — your van's dashboard should appear at
+   the address you configured.
+
+### 6.4 What to do if it goes wrong
+
+Three things can go sideways with Wireguard, and each has a
+one-step fix.
+
+- **"Install the Wireguard add-on, then paste your server
+  details."** This means the wizard can't see Wireguard yet. Go
+  back to step 1 and make sure the Wireguard add-on is installed
+  AND running. Once it's running, the sentence will change on its
+  own — you don't need to refresh anything.
+
+- **"We couldn't reach your Wireguard server. Check that the
+  server is reachable from your van's internet connection and
+  that UDP 51820 is open on the server's firewall."** This means
+  the wizard tried to talk to your Wireguard server and couldn't.
+  The most common causes are: the server is offline, the server's
+  firewall is blocking UDP 51820, or the van's LTE/Starlink
+  internet is currently down. Check the Wireguard app on your
+  phone — if it can't reach the server either, the problem is on
+  the server side. Your keys are still in the boxes — you don't
+  need to type them again.
+
+- **The tunnel doesn't connect on your phone.** Double-check that
+  the four values in the boxes exactly match what your Wireguard
+  server has on file — endpoint, server public key, peer private
+  key, and allowed IPs. The most common slip is a typo in the
+  endpoint (missing port, wrong domain) or a swapped key. Fix the
+  mismatched value in the box and the dashboard will retry on its
+  own.
+
+If none of those fix it, wait five minutes and try again — the
+server can take a moment to catch up after a fresh key install.
+If it's still stuck after that, the cleanest fix is to remove the
+Wireguard add-on, reinstall it, and walk through these four steps
+again from the top. Your Wireguard server and keys don't change,
+so you won't lose anything.
+
+### 6.5 Useful links
+
+- Wireguard project page: https://www.wireguard.com/
+- Home Assistant Wireguard add-on (HACS):
+  https://github.com/community-scripts/hassio-addons/tree/main/wireguard
+- How to generate Wireguard keys: https://www.wireguard.com/quickstart/