wgtunnel: S3 Part 3 — FELHOM_WG sudoers + capabilities + config (DEFAULT OFF) + main wiring + escrow join

Sudoers: fixed-path conf install, enable/restart/disable, latest-handshakes-only
wg read (dump FORBIDDEN — the S1 incident). 6 capability-manifest entries
(Critical=false until S4 makes the tunnel load-bearing). WGTunnelConfig with
enabled=false DEFAULT (the safety gate: a v0.64.0 rollout without explicit
config is a no-op). Daemon wiring mirrors lanresolver + AddConsumer +
SetWireguardReporter; --selftest=wgtunnel single-shot. IdentityBundle
+wg_private_key (omitempty; pre-S3 blobs cannot be retrofitted — documented)
with escrow-create auto-inject (field name only in logs). Red-proof (e) run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/config/config.go

@@ -22,18 +22,40 @@ import (
 
 // Config is the agent configuration.
 type Config struct {
-	Proxmox    ProxmoxConfig    `json:"proxmox"`
-	Privileged PrivilegedConfig `json:"privileged"`
-	Authz      AuthzConfig      `json:"authz"`
-	Hub        HubConfig        `json:"hub"`
-	Storage    StorageConfig    `json:"storage"`
-	Backup     BackupConfig     `json:"backup"`
+	Proxmox     ProxmoxConfig     `json:"proxmox"`
+	Privileged  PrivilegedConfig  `json:"privileged"`
+	Authz       AuthzConfig       `json:"authz"`
+	Hub         HubConfig         `json:"hub"`
+	Storage     StorageConfig     `json:"storage"`
+	Backup      BackupConfig      `json:"backup"`
 	Escrow      EscrowConfig      `json:"escrow"`
 	LocalAPI    LocalAPIConfig    `json:"local_api"`
 	LANResolver LANResolverConfig `json:"lan_resolver"`
+	WGTunnel    WGTunnelConfig    `json:"wg_tunnel"`
 	LogLevel    string            `json:"log_level"` // debug|info|warn|error (default info)
 }
 
+// WGTunnelConfig configures the offsite WireGuard tunnel (S3, doc 06). **Enabled DEFAULTS TO
+// FALSE — the safety gate:** agent releases roll to near-production boxes, and auto-registering
+// one into the DEV endpoint on update would be wrong. Enable explicitly per box; the default
+// flips only when the production endpoint exists (a later, deliberate decision).
+type WGTunnelConfig struct {
+	Enabled         bool   `json:"enabled"`
+	IntervalSeconds int    `json:"interval_seconds"` // reconcile cadence; default 60
+	StateDir        string `json:"state_dir"`        // key/marker/staged-conf under <StateDir>/wg/; default /var/lib/felhom-agent (the FELHOM_WG sudoers install entry hard-codes this default)
+}
+
+// WithDefaults fills interval + state dir.
+func (w WGTunnelConfig) WithDefaults() WGTunnelConfig {
+	if w.IntervalSeconds == 0 {
+		w.IntervalSeconds = 60
+	}
+	if w.StateDir == "" {
+		w.StateDir = "/var/lib/felhom-agent"
+	}
+	return w
+}
+
 // LANResolverConfig configures the host-level split-horizon DNS resolver (internal/lanresolver): a
 // dnsmasq the agent manages so LAN clients reach their guest DIRECTLY at the same hostname + real cert.
 // Disabled unless Enable is set. HostIP defaults to the local-API bridge IP (the host LAN anchor);