Leave enabling wg0 at boot to the user's init system

The script ran systemctl, which is a guess: the backend host is Gentoo
and only the dev VM is systemd. It now does the distro-agnostic part --
wg-quick up, or an in-place peer reload via wg syncconf when wg0 is
already up, so a re-run doesn't drop a connected phone -- and prints the
persistence command for OpenRC, systemd, or netifrc instead of picking
one.

Both paths tested in the VM: fresh bring-up, and re-run against a live
wg0 reusing the existing keys so the phone's config stays valid.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017xn8nHw1tw1R6PtiY1eEtw

wg-setup-host.sh

@@ -9,7 +9,10 @@
 # What it creates:
 #   /etc/wireguard/wg0.conf        the backend's tunnel: 10.66.0.1, port 51820
 #   /etc/wireguard/peers/phone.conf  the phone's config, shown as a QR to scan
-# and enables wg-quick@wg0 so the tunnel comes back after a reboot.
+# and brings the interface up with wg-quick. Making it come back after a
+# reboot is left to you: that is the one step whose commands differ per init
+# system, and this script would only be guessing (the backend host is Gentoo,
+# the dev VM is Arch). It prints what to run at the end.
 #
 # Addressing matches PLAN.md: the phone reaches the backend at 10.66.0.1 from
 # everywhere, home or away -- one address in the app, one SAN in the leaf
@@ -101,12 +104,20 @@ AllowedIPs = $SUBNET
 PersistentKeepalive = 25
 EOF
 
-echo "==> Enabling wg-quick@wg0"
-systemctl enable --now "wg-quick@wg0" >/dev/null 2>&1 || {
-    echo "    systemctl failed; bringing it up directly instead"
-    wg-quick down wg0 >/dev/null 2>&1 || true
+if wg show wg0 >/dev/null 2>&1; then
+    # Already up: load the new peers without dropping the interface, so a
+    # re-run doesn't kill a connected phone mid-session. `wg-quick strip`
+    # prints the config with the wg-quick-only keys removed, which is what
+    # `wg syncconf` accepts.
+    echo "==> wg0 is already up -- reloading its peers in place"
+    STRIPPED=$(mktemp)
+    trap 'rm -f "$STRIPPED"' EXIT
+    wg-quick strip wg0 > "$STRIPPED"
+    wg syncconf wg0 "$STRIPPED"
+else
+    echo "==> Bringing wg0 up"
     wg-quick up wg0
-}
+fi
 sleep 1
 wg show wg0 | sed 's/^/    /'
 
@@ -121,6 +132,13 @@ else
 fi
 echo
 echo "Still to do, in order:"
+echo "  0. Make wg0 come back after a reboot. Left to you rather than"
+echo "     guessed at, since the command depends on your init system:"
+echo "       OpenRC:   ln -s /etc/init.d/wg-quick /etc/init.d/wg-quick.wg0"
+echo "                 rc-update add wg-quick.wg0 default"
+echo "       systemd:  systemctl enable wg-quick@wg0"
+echo "     (Gentoo with netifrc instead of wg-quick: configure net.wg0 in"
+echo "     /etc/conf.d/net -- see the WireGuard page on the Gentoo wiki.)"
 echo "  1. Forward UDP $PORT on your router to this host. That is the only"
 echo "     internet-facing port; it stays silent to unauthenticated packets."
 echo "  2. Point $ENDPOINT at your home IP (DDNS client on the router, or a"