feat: Changed openvpn for wireguard

control.sh

@@ -210,13 +210,14 @@ guided() {
   cat <<EOF
 This walks the whole bring-up in the order the firewalls require. dev/prod only
 accept SSH from the vpn server's public IP, so vpn must exist and you must be
-connected to it (OpenVPN) before dev/prod are reachable.
+connected to it (WireGuard, via wg-easy) before dev/prod are reachable.
 
 Steps, in order:
   0. Configuration: variables + terraform.tfvars (skip if already done)
   1. OpenTofu: init -> plan -> apply   (creates servers, network, firewalls, DNS)
   2. Ansible:  bootstrap + deploy + spinup for role_vpn
-  3. YOU:      connect to the VPN with an OpenVPN client
+  3. YOU:      visit https://vpn.luke-else.co.uk, complete wg-easy's setup,
+               add a client peer, and connect with a WireGuard client
   4. Ansible:  bootstrap + deploy + spinup for role_dev,role_prod
 EOF
   confirm "Start the guided walkthrough?" || return 0
@@ -240,7 +241,7 @@ EOF
   fi
 
   echo; title "3/4  Connect the VPN"
-  warn "Connect to the vpn server with your OpenVPN client now, then continue."
+  warn "Visit https://vpn.luke-else.co.uk, complete wg-easy's setup wizard, add a client peer, and connect with a WireGuard client now."
   confirm "Are you connected to the VPN?" || { warn "Stopping - reconnect and re-run this step."; return 0; }
 
   echo; title "4/4  Ansible - dev + prod"