4 files changed, 74 insertions, 6 deletions
diff --git a/roles/gateway/README.md b/roles/gateway/README.md
index cfbe49d3..d57ce6ff 100644
--- a/roles/gateway/README.md
+++ b/roles/gateway/README.md
@@ -23,17 +23,28 @@ IPv6 gateway is enabled by setting both `network_ipv6_address` and `gateway_loca
 
 ```yaml
 network_ipv6_address: "2a02:xxxx:xxxx:xxxx::254/64"   # Pi's IPv6 address
-gateway_local_ipv6_subnet: "2a02:xxxx:xxxx:xxxx::/64" # LAN IPv6 subnet
+gateway_local_ipv6_subnet: "2a02:xxxx:xxxx:xxxx::/64" # LAN IPv6 subnet (advertised via radvd)
 ```
 
-To disable IPv6 entirely, remove both variables from `host_vars`. The role will:
-- Omit `accept_ra` sysctl (no IPv6 interface key written)
-- Skip IPv6 iptables masquerade rules (`gateway_local_ipv6_subnet` defaults to `""`)
+When `network_ipv6_address` is defined, the role:
+- Enables IPv6 forwarding (`net.ipv6.conf.all.forwarding=1`)
+- Sets `accept_ra=2` on `gateway_router_interface` so Pi keeps receiving RAs from the router while forwarding
+- Configures and starts `radvd` — Pi sends Router Advertisements to the LAN advertising itself as the IPv6 default gateway with `AdvDefaultPreference high`
+- Announces Pi-hole (Pi's IPv6) as RDNSS so all devices use it for DNS over IPv6
+
+This mirrors the IPv4 setup: all LAN devices (including phones) auto-configure Pi as their IPv6 gateway via SLAAC. No static configuration needed on clients.
+
+To disable IPv6 entirely, remove `network_ipv6_address` and `gateway_local_ipv6_subnet` from `host_vars`. The role will:
+- Omit `accept_ra` sysctl
+- Skip IPv6 iptables masquerade rules
+- Stop and disable radvd, remove its config
 - Leave `net.ipv6.conf.all.forwarding=0`
 
 **Note:** `accept_ra` is set per-interface (`gateway_router_interface`) only when IPv6 is enabled.
 This prevents rogue RA acceptance on WireGuard and LAN interfaces.
 
+**FritzBox:** Set RA priority to **Low** (Home Network → Network → IPv6 → Router advertisement → priority) so Pi's `high` priority RA wins. Pi becomes the sole IPv6 default gateway for all LAN devices.
+
 ## Network Architecture
 
 ```txt
@@ -70,7 +81,7 @@ Client Devices (192.168.1.0/24)
 ## Requirements
 
 - **WireGuard Interfaces**: Must follow `wg*` naming pattern (`wg0`, `wg-us1`, etc.)
-- **Client Configuration**: Devices must use Pi as default gateway (192.168.1.254)
+- **Client Configuration**: IPv4 devices use Pi as gateway via Pi-hole DHCP; IPv6 devices auto-configure via radvd RAs
 - **IP Forwarding**: Kernel IP forwarding must be enabled (`net.ipv4.ip_forward=1`)
 - **WireGuard Config**: Use default routing (`Table=auto` or unset, NOT `Table=off`)
 
diff --git a/roles/gateway/handlers/main.yml b/roles/gateway/handlers/main.yml
index 35cc489c..2220f965 100644
--- a/roles/gateway/handlers/main.yml
+++ b/roles/gateway/handlers/main.yml
@@ -15,3 +15,9 @@
   ansible.builtin.command:
     cmd: "udevadm control --reload-rules"
   changed_when: false
+
+- name: "Restart radvd"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "radvd.service"
+    state: "restarted"
diff --git a/roles/gateway/tasks/main.yml b/roles/gateway/tasks/main.yml
index f4826a72..6684bb9a 100644
--- a/roles/gateway/tasks/main.yml
+++ b/roles/gateway/tasks/main.yml
@@ -1,11 +1,12 @@
 ---
-- name: "Ensure iptables and iproute2 are installed"
+- name: "Ensure gateway packages are installed"
   become: true
   ansible.builtin.package:
     name:
       - "iptables"
       - "iproute2"
       - "udev"
+      - "radvd"
     state: "present"
 
 - name: "Configure IP forwarding"
@@ -67,3 +68,38 @@
     name: "gateway-init.service"
     enabled: "{{ gateway_enabled }}"
     daemon_reload: true
+
+- name: "Configure radvd for IPv6 gateway"
+  become: true
+  when: network_ipv6_address is defined
+  block:
+    - name: "Configure radvd"
+      ansible.builtin.template:
+        src: "radvd.conf.j2"
+        dest: "/etc/radvd.conf"
+        owner: "root"
+        group: "root"
+        mode: "0644"
+      notify: "Restart radvd"
+
+    - name: "Enable radvd service"
+      ansible.builtin.systemd_service:
+        name: "radvd.service"
+        enabled: true
+        state: "started"
+        daemon_reload: true
+
+- name: "Disable radvd (no IPv6)"
+  become: true
+  when: network_ipv6_address is not defined
+  block:
+    - name: "Disable radvd service"
+      ansible.builtin.systemd_service:
+        name: "radvd.service"
+        enabled: false
+        state: "stopped"
+
+    - name: "Remove radvd config"
+      ansible.builtin.file:
+        path: "/etc/radvd.conf"
+        state: "absent"
diff --git a/roles/gateway/templates/radvd.conf.j2 b/roles/gateway/templates/radvd.conf.j2
new file mode 100644
index 00000000..9aac075d
--- /dev/null
+++ b/roles/gateway/templates/radvd.conf.j2
@@ -0,0 +1,15 @@
+interface {{ gateway_router_interface }} {
+    AdvSendAdvert on;
+    AdvManagedFlag off;
+    AdvOtherConfigFlag on;
+    AdvDefaultPreference high;
+
+    prefix {{ gateway_local_ipv6_subnet }} {
+        AdvOnLink on;
+        AdvAutonomous on;
+        AdvRouterAddr on;
+    };
+
+    RDNSS {{ network_ipv6_address.split('/')[0] }} {
+    };
+};