docs: identify WG endpoint as ProtonVPN Seattle; Mac gate is a second dashboard WG config

serverAppConfigs-docs/log.md

@@ -11,6 +11,22 @@ timestamp: 2026-09-14
 
 # Bundle Change Log
 
+## 2026-09-01 - WG endpoint identified as ProtonVPN Seattle; Mac gate is a second dashboard config
+- RDAP: `149.102.254.77` = CDNEXT-CG-SEA (Datacamp Limited, Proton's Seattle
+  hosting partner); Dankclaw's tunnel v6 `2a07:b944::2:2` sits in
+  CH-PROTONVPN-20160719; observed exit IP `149.22.88.19` = CDNEXT-SEA-CG.
+  The "custom WG server" is a ProtonVPN Seattle WireGuard server - there is
+  no peer-registration step on any box of ours (no SSH, only silent TLS
+  listeners on 443/4443/4444/8443).
+- Mac gate corrected: provision a **second** Proton WG config (dashboard,
+  named e.g. `frankbook`) - one config = one keypair; two hosts on
+  Dankclaw's config bounce the server-side endpoint and kill SearXNG. Values
+  paste straight into the gluetun `custom` env. Earlier prepared keypair on
+  dankclaw (`~/frankbook-wg/`) retired to `~/.AGENTTRASH/` (Proton generates
+  the keypair per config; no BYO pubkey).
+### 
+- [[FrankBook-Pro]] provisioning section rewritten.
+
 ## 2026-09-01 — Jellyfin authentication moved to Authentik LDAP
 - `/dankclaw/authentik/quadlet/authentik-outpost-ldap.container` (`4ad85fa`,
   digest-pinned in `f4ef2b8`) — new `authentik-outpost-ldap.service` on