diff --git a/sim/cluster0/cluster.env b/sim/cluster0/cluster.env
index 665172c..cad6f13 100644
--- a/sim/cluster0/cluster.env
+++ b/sim/cluster0/cluster.env
@@ -17,6 +17,9 @@ CAST_DOMAIN=intra.raptor.org
 PRIMARY_DB_HOST=cast01
 PRIMARY_DB_PORT=3306
 
+# DB_BACKEND: 1=MariaDB (default), 2=PostgreSQL/TimescaleDB, 3=SQLite3
+DB_BACKEND=1
+
 ARTC0_HOST=artc0
 ARTC0_IP=10.7.16.128
 # DEPRECATED: legacy dev VM — FE/compose no longer target artc0; kept for DNS cleanup only.
diff --git a/sim/cluster0/scripts/deploy-remote-access-lab.sh b/sim/cluster0/scripts/deploy-remote-access-lab.sh
index ee7f405..2d99958 100755
--- a/sim/cluster0/scripts/deploy-remote-access-lab.sh
+++ b/sim/cluster0/scripts/deploy-remote-access-lab.sh
@@ -9,6 +9,15 @@ load_secrets_lab 2>/dev/null || true
 
 is_primary_node || { log "deploy-remote-access-lab: skip (not primary)"; exit 0; }
 
+# Ensure iptables is available (needed for WireGuard PostUp/PostDown NAT rules)
+if ! command -v iptables >/dev/null 2>&1; then
+  log "iptables not found; installing via apk"
+  apk add --no-cache iptables >/dev/null 2>&1 || log "WARN: iptables install failed — PostUp/PostDown may error"
+fi
+
+# Load wireguard kernel module if not already loaded
+modprobe wireguard 2>/dev/null || true
+
 WG_EXAMPLES="${AC_WORKSPACE_ROOT:-/var/www/ac/workspace}/ac-ms-remote-access/examples/wireguard"
 [ -d "$WG_EXAMPLES" ] || die "missing $WG_EXAMPLES (init ac-ms-remote-access submodule)"