From b76953bfb46932d28d4941cea0482f1dc2030dca Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Tue, 31 Mar 2026 13:02:21 +1000
Subject: [PATCH] doc tweaks

---
 docs/installing-spinifex/README.md |  8 ++++++++
 scripts/setup.sh                   | 16 ++++++++++------
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/docs/installing-spinifex/README.md b/docs/installing-spinifex/README.md
index 832c9fbfd..26fbfe660 100644
--- a/docs/installing-spinifex/README.md
+++ b/docs/installing-spinifex/README.md
@@ -75,6 +75,14 @@ sudo /usr/local/share/spinifex/setup-ovn.sh --management --wan-bridge=br-wan --w
 sudo /usr/local/share/spinifex/setup-ovn.sh --management --macvlan --wan-iface=enp0s3
 ```
 
+**Separating VPC tunnel traffic from WAN:** If you want Geneve tunnel traffic (inter-VM east-west) to use a dedicated interface instead of the WAN IP, add `--encap-ip=<IP>` to specify the tunnel endpoint address:
+
+```bash
+sudo /usr/local/share/spinifex/setup-ovn.sh --management --encap-ip=10.0.0.1
+```
+
+This is recommended for production and required in multi-node deployments. See [Multi-Node Installation](/docs/installing-spinifex-multi-node) for details.
+
 ## Step 3. Initialize
 
 ```bash
diff --git a/scripts/setup.sh b/scripts/setup.sh
index e2b4be756..04aea59e1 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -341,13 +341,17 @@ print_summary() {
     echo "  Next steps:"
     echo ""
     echo "  1. Setup OVN networking:"
-    echo "     sudo /usr/local/share/spinifex/setup-ovn.sh --management"
-    echo "     # If WAN is a physical NIC (not a bridge), add:"
-    echo "     #   --wan-bridge=br-wan --wan-iface=<WAN_NIC>   (dedicated WAN NIC)"
-    echo "     #   --macvlan --wan-iface=<WAN_NIC>              (single-NIC, SSH-safe)"
+    echo "     If your WAN interface is already a bridge (e.g. br-wan):"
+    echo "       sudo /usr/local/share/spinifex/setup-ovn.sh --management"
     echo ""
-    echo "  2. Initialize a region:"
-    echo "     sudo spx admin init --region <region> --az <az> --node node1 --nodes 1"
+    echo "     If your WAN is a physical NIC:"
+    echo "       # Dedicated WAN NIC (not your SSH connection):"
+    echo "       sudo /usr/local/share/spinifex/setup-ovn.sh --management --wan-bridge=br-wan --wan-iface=eth1"
+    echo "       # Single-NIC host (SSH-safe macvlan):"
+    echo "       sudo /usr/local/share/spinifex/setup-ovn.sh --management --macvlan --wan-iface=enp0s3"
+    echo ""
+    echo "  2. Initialize:"
+    echo "     sudo spx admin init --node node1 --nodes 1"
     echo ""
     echo "  3. Start services:"
     echo "     sudo systemctl start spinifex.target"