From 00b8897b9d931ea3ba524a3a2dea7f3bb074ae31 Mon Sep 17 00:00:00 2001
From: nexxo <nexxo@clupilot.local>
Date: Sat, 25 Jul 2026 10:49:43 +0200
Subject: [PATCH] fix(engine): compute default WireGuard hub IP from the CIDR
 network

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 config/provisioning.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/config/provisioning.php b/config/provisioning.php
index ee321f7..2fd11e5 100644
--- a/config/provisioning.php
+++ b/config/provisioning.php
@@ -1,9 +1,11 @@
 <?php
 
 use App\Provisioning\Steps\Host;
-use Illuminate\Support\Str;
 
 $wgSubnet = env('CLUPILOT_WG_SUBNET', '10.66.0.0/24');
+[$wgNetwork, $wgBits] = array_pad(explode('/', $wgSubnet), 2, '24');
+$wgBase = ip2long($wgNetwork) & (0xFFFFFFFF << (32 - (int) $wgBits)) & 0xFFFFFFFF;
+$wgHubDefault = long2ip($wgBase + 1); // first usable address in the CIDR
 
 return [
     /*
@@ -29,7 +31,7 @@ return [
     // CluPilot VM acts as the WireGuard hub; hosts join it during onboarding.
     'wireguard' => [
         'subnet' => $wgSubnet,
-        'hub_ip' => env('CLUPILOT_WG_HUB_IP', Str::beforeLast($wgSubnet, '.').'.1'), // handshake target
+        'hub_ip' => env('CLUPILOT_WG_HUB_IP', $wgHubDefault), // handshake target
         'endpoint' => env('CLUPILOT_WG_ENDPOINT', ''),        // host:port reachable by peers
         'hub_public_key' => env('CLUPILOT_WG_HUB_PUBKEY', ''),
         'config_path' => env('CLUPILOT_WG_CONFIG_PATH', '/etc/wireguard/wg0.conf'),