Detect Netbird/Tailscale too before offering wg-easy at the DR-spare prompt

Requested: don't push the operator toward installing wg-easy if they
already have a different mesh VPN (Netbird or Tailscale) running —
detect any of the three first, and only offer a choice when none are
present.

Detection checks wg-easy's own directory (this repo's install marker),
then falls back to checking whether the netbird/tailscale binaries exist
AND their systemd services are actually active — not just installed,
since an installed-but-never-connected client isn't a usable path to the
spare box either. wg-easy takes priority if somehow more than one is
present, since it's this repo's own chain-installable option.

When none are detected, offers a numbered choice: wg-easy (chain-installs
via the existing declare -F guard), Netbird, or Tailscale (both via their
official curl-pipe-sh installers — verified the current URLs against
each vendor's own docs rather than guessing, since a wrong URL here would
be a bad thing to ship). Both third-party options still need a manual
follow-up step this script can't complete unattended (Netbird needs a
setup key from the operator's account, Tailscale needs an interactive
auth link) — the success message says so rather than implying the
install alone finishes the job.

Verified the detection branching against all the cases that matter:
nothing present, only wg-easy's directory, only Netbird active, only
Tailscale active, and multiple present at once (wg-easy correctly wins).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn

services/backup.sh

@@ -499,19 +499,55 @@ install_backup() {
 
             # If the spare isn't reachable at all (behind NAT, no port-forward —
             # a home box is the common case), a passwordless key won't help
-            # until there's a network path there in the first place. Offer the
-            # VPN hub right here instead of just telling the user to go set
-            # one up separately and come back.
-            if [ ! -d "$DOCKER_DIR/wg-easy" ]; then
-                local _SETUP_VPN=""
-                prompt_yn "  Spare box not directly reachable (behind NAT, no port-forward)? Set up a WireGuard VPN hub (wg-easy) now so they can reach each other? (y/n):" "n" _SETUP_VPN
-                if [[ "$_SETUP_VPN" =~ ^[Yy]$ ]]; then
-                    if declare -F install_wg-easy >/dev/null 2>&1; then
-                        install_wg-easy
-                    else
-                        log_warning "  services/wg-easy.sh isn't loaded — run: sudo ./setup.sh wg-easy"
-                    fi
-                fi
+            # until there's a network path there in the first place. Check
+            # for an already-running mesh VPN first — wg-easy (this repo's
+            # own), Netbird, or Tailscale are all common, and if the
+            # operator already has any ONE of them running, pushing them
+            # toward installing a second, redundant mesh would be actively
+            # wrong. Only offer a choice when none of the three are present.
+            local _VPN_DETECTED=""
+            if [ -d "$DOCKER_DIR/wg-easy" ]; then
+                _VPN_DETECTED="wg-easy"
+            elif command -v netbird >/dev/null 2>&1 && systemctl is-active --quiet netbird 2>/dev/null; then
+                _VPN_DETECTED="Netbird"
+            elif command -v tailscale >/dev/null 2>&1 && systemctl is-active --quiet tailscaled 2>/dev/null; then
+                _VPN_DETECTED="Tailscale"
+            fi
+
+            if [ -n "$_VPN_DETECTED" ]; then
+                log_info "  Detected $_VPN_DETECTED already running — use its address for the spare box"
+                log_info "  destination above instead of the public one, if you haven't already."
+            else
+                echo ""
+                echo "    1) wg-easy — this repo's own guided WireGuard hub (chain-installs now)"
+                echo "    2) Netbird — official installer (needs a setup key from your Netbird"
+                echo "       account/self-hosted server — https://docs.netbird.io)"
+                echo "    3) Tailscale — official installer (opens an auth link to your account —"
+                echo "       https://tailscale.com)"
+                echo "    4) Skip"
+                echo ""
+                local _VPN_CHOICE=""
+                prompt_text "  Spare box not directly reachable? Set up a VPN mesh now [4]:" "4" _VPN_CHOICE
+                case "${_VPN_CHOICE:-4}" in
+                    1)
+                        if declare -F install_wg-easy >/dev/null 2>&1; then
+                            install_wg-easy
+                        else
+                            log_warning "  services/wg-easy.sh isn't loaded — run: sudo ./setup.sh wg-easy"
+                        fi
+                        ;;
+                    2)
+                        curl -fsSL https://pkgs.netbird.io/install.sh | sh \
+                            && log_success "  Netbird installed — finish setup with: netbird up --setup-key <YOUR_SETUP_KEY>" \
+                            || log_warning "  Netbird install failed — see https://docs.netbird.io/get-started/install/linux"
+                        ;;
+                    3)
+                        curl -fsSL https://tailscale.com/install.sh | sh \
+                            && log_success "  Tailscale installed — finish setup with: tailscale up" \
+                            || log_warning "  Tailscale install failed — see https://tailscale.com/docs/install/linux"
+                        ;;
+                    *) : ;;
+                esac
             fi
 
             local _HAVE_KEY=false