From 5694fdc56cc5a8850041c03b3d16766b8683aef6 Mon Sep 17 00:00:00 2001
From: n0mad1k <n0mad1k@localhost>
Date: Tue, 17 Mar 2026 16:03:21 -0400
Subject: [PATCH] =?UTF-8?q?WireGuard=20as=20primary=20C2=20=E2=80=94=20zer?=
 =?UTF-8?q?o=20traffic=20when=20idle,=20on-demand=20connect.=20Tailscale?=
 =?UTF-8?q?=20moves=20to=20fallback.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 BIGBROTHER_DESIGN.md | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/BIGBROTHER_DESIGN.md b/BIGBROTHER_DESIGN.md
index 40789ef..a7851aa 100644
--- a/BIGBROTHER_DESIGN.md
+++ b/BIGBROTHER_DESIGN.md
@@ -634,8 +634,8 @@ Parse output from all managed tools into structured data:
 
 | Module | Purpose | Resources |
 |---|---|---|
-| `tailscale.py` | Primary operator access via Tailscale mesh VPN. Pre-auth key, engagement ACL tags. OPSEC: check baseline for existing Tailscale traffic first. | 30MB, 2% |
-| `wireguard.py` | Fallback VPN to operator endpoint. Lower overhead. Preferred when Tailscale would be a new destination. | 5MB, 1% |
+| `tailscale.py` | Fallback operator access via Tailscale mesh VPN. Convenient but chatty — maintains connection to coordination servers. Only use if target network already has Tailscale traffic or WireGuard is blocked. | 30MB, 2% |
+| `wireguard.py` | **Primary C2.** WireGuard to operator's self-hosted endpoint. `PersistentKeepalive = 0` — tunnel exists but generates **zero traffic** until operator connects. No beacons, no heartbeats, no coordination servers. Completely silent while idle, instant access when operator sends a packet. | 5MB, 1% |
 | `bridge.py` | Transparent inline bridge (USB eth + onboard). No IP on network. 802.1X bypass (silentbridge). STP/BPDU/CDP suppression via ebtables. C watchdog failsafe <15s. | 10MB, 2% |
 | `wifi_client.py` | WPA2-PSK/Enterprise WiFi client. wpa_supplicant managed. | 10MB, 1% |
 | `reverse_tunnel.py` | autossh reverse SSH. Must be SSH-over-WebSocket or SSH inside TLS (stunnel). Never raw SSH on 443. | 15MB, 1% |
@@ -998,8 +998,8 @@ network:
     modem_device: "/dev/ttyUSB0"
 
 connectivity:
-  primary: "tailscale"
-  failover_chain: [tailscale, wireguard, reverse_tunnel, cellular_backup]
+  primary: "wireguard"            # Zero traffic when idle, instant access on demand
+  failover_chain: [wireguard, tailscale, reverse_tunnel, cellular_backup]
 
 security:
   encryption_key_derive: "argon2id"  # argon2id | pbkdf2 (Pi Zero)
@@ -1285,7 +1285,7 @@ Tasks:
 
 30. **Bridge mode** -- No IP, no MAC on network. Physical inspection only.
 31. **MAC profile** -- Device appears as consumer electronics (Fire TV, Roku, etc.), not Raspberry Pi.
-32. **Tailscale** -- Check baseline for existing traffic before using. Prefer WireGuard otherwise.
+32. **WireGuard primary** -- Zero traffic when idle (`PersistentKeepalive = 0`). Self-hosted endpoint, no third-party coordination servers. Tailscale only as fallback if WireGuard is blocked or target already has Tailscale traffic.
 33. **Reverse SSH** -- SSH-over-WebSocket or inside TLS (stunnel). Never raw SSH on 443.
 34. **Data exfil** -- Timed to match baseline upload patterns via traffic_mimicry.
 35. **bettercap REST API** -- Bound to 127.0.0.1 only. Not network-visible.