post-check and docs for NetworkManager WANs

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

deploy.sh

@@ -19,6 +19,9 @@
 #                                    # test-only flags: --backup --netplan-dir --log --status --sysnet --rendered --deadlines "s1 s2 rc" --stamp
 #         ./deploy.sh render <file>        # preview a templated file on stdout
 #         ./deploy.sh --redact             # filter stdin, masking secret values (used by --diff; for tests)
+#         VANLINK_SYSNET=<dir>             # test override: sysfs net dir used by --post-check (default /sys/class/net)
+#         VANLINK_FAILOVER_STATE=<file>    # test override: van-failover state file read by --post-check (default /run/van-failover/state.json)
+#         VANLINK_APPLY_STATUS=<file>      # test override: apply-network status file read by --post-check (default /var/lib/vanlink/apply-network.status)
 #         VANLINK_NM_DIR=<dir>             # test override: where existing NM *.nmconnection files are looked up (default /etc/NetworkManager/system-connections)
 # Idempotent. Netplan (the NM-managed WANs; eth0 is a LAN port on br0) is never
 # changed by a routine deploy (applying it flaps the uplinks). ENABLE_NM_WAN=0:
@@ -280,6 +283,55 @@ post_check() {  # read-only live checks; every probe is guarded, warns instead o
     if [ -z "$out" ]; then warn "post-deploy: no default route"
     elif ping -c1 -W2 1.1.1.1 >/dev/null 2>&1; then echo "   ok    uplink: default route, 1.1.1.1 reachable"
     else warn "post-deploy: default route present but 1.1.1.1 does not answer ping"; fi
+    if [ "$ENABLE_NM_WAN" = 1 ]; then
+        local sysnet=${VANLINK_SYSNET:-/sys/class/net} nmst fst as_f as_l
+        # h. NetworkManager must leave the AP/LAN radios and ports alone
+        nmst=$(nmcli -t -f DEVICE,STATE device 2>/dev/null) || nmst=
+        for n in "$WIFI_5G_IFACE" "$WIFI_2G_IFACE" "$LAN_IFACE" "${ONBOARD_LAN_IFACE:-}"; do
+            [ -n "$n" ] && [ -e "$sysnet/$n" ] || continue
+            if [[ $'\n'$nmst == *$'\n'"$n:unmanaged"* ]]; then echo "   ok    NetworkManager leaves $n unmanaged"
+            else warn "post-deploy: NetworkManager manages $n (or its state is unknown) — expected unmanaged; check /etc/NetworkManager/conf.d/"; fi
+        done
+        # i. cellular connection
+        if [ -n "${CELLULAR_APN:-}" ]; then
+            if { nmcli -t -f NAME connection show 2>/dev/null || true; } | grep -qxF "$CELLULAR_CONN_NAME" || cellular_profile_exists; then
+                echo "   ok    NetworkManager connection $CELLULAR_CONN_NAME exists"
+            else warn "post-deploy: NetworkManager connection $CELLULAR_CONN_NAME not found"; fi
+        fi
+        # j. van-failover state: every WAN whose device exists must be present
+        fst=${VANLINK_FAILOVER_STATE:-/run/van-failover/state.json}
+        if out=$(python3 - "$fst" "$sysnet" 2>/dev/null <<'PY'
+import json, os, sys
+try:
+    with open(sys.argv[1]) as f:
+        wans = json.load(f)["wans"]
+    for w in wans:
+        dev = w.get("device") or ""
+        if dev and os.path.exists(os.path.join(sys.argv[2], dev)):
+            print(("ok" if w.get("present") is True else "notpresent"), w.get("name", "?"), dev)
+except Exception:
+    sys.exit(3)
+PY
+        ); then
+            while read -r as_f as_l n; do
+                [ -n "$as_f" ] || continue
+                if [ "$as_f" = ok ]; then echo "   ok    van-failover: WAN $as_l ($n) present"
+                else warn "post-deploy: van-failover reports WAN $as_l ($n) not present although the device exists"; fi
+            done <<<"$out"
+        else warn "post-deploy: van-failover state $fst missing or unreadable"; fi
+        # k. netplan drift
+        f=$(nm_wan_state_netplan)
+        [ "$f" = matches ] && echo "   ok    WAN netplan matches" || warn "post-deploy: WAN netplan $f — run ./deploy.sh --apply-network"
+        # l. last --apply-network
+        as_f=${VANLINK_APPLY_STATUS:-/var/lib/vanlink/apply-network.status}
+        if [ -r "$as_f" ]; then
+            as_l=$(head -n1 "$as_f" 2>/dev/null) || as_l=
+            case "${as_l%% *}" in
+                ok) echo "   ok    last --apply-network: $as_l" ;;
+                running|rolled-back|rollback-failed) warn "post-deploy: last --apply-network status: $as_l — see /var/log/vanlink-apply-network.log" ;;
+            esac
+        fi
+    fi
 }
 
 # --apply-network time budgets (seconds), in one place; all derived from the AN_* constants.