apply-network: final-review fixes (diagnostics, NM off the uplink until handover, preflight, stricter stage 2)

I-1 helper logs diagnostics (nmcli, DHCP routers, networkctl -n 0, ip addr, ip route; each
    under timeout 5) before a stage 1/2 restore, and the port's networkctl list line on success
    (information only, never gating).
I-2 ap/nm-uplink-pending.conf -> /etc/NetworkManager/conf.d/zz-van-wan-pending.conf keeps NM
    off STARLINK_IFACE while the WAN netplan is missing; installed before network-manager,
    removed once the netplan matches, left as is when it differs (port already handed to NM).
    apply_network backs it up as nm-pending.conf; the helper removes it + reloads NM conf right
    before netplan generate/apply, restore() puts it back and reloads after the re-apply.
    --wan-plan prints "uplink NM pending conf: ...".
I-3 nm_wan_state_netplan: "unreadable" (0600 file, non-root); --wan-plan and post-check say so
    without warning.
I-4 apply_preflight_problems (+ hidden --apply-preflight, VANLINK_HOSTNAME test knob ignored as
    root): port absent / conf of another host -> refused without --force. Stage 2 also needs
    van-failover's own "proto static" default route on the port.
M-1 helper restarts van-br0-setup (if the unit exists) after the forward netplan apply.
M-3 nm_pkg_installed (dpkg-query Status) in deploy, --wan-plan and --apply-network.
M-5 header documents VANLINK_CONF; stale test comment fixed.
M-6 cellular_profile_exists ignores VANLINK_NM_DIR as root.
M-7 tests: NM-off files installed before network-manager; read-only sub-commands never apt-get.
M-8 an existing, differing WAN netplan is shown (redact_secrets now masks YAML password:) and
    refused without --force.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9
This commit is contained in:
2026-09-23 19:41:02 -04:00
co-authored by Claude Opus 5.5
parent 5c18bcdad6
commit 3fce6a7907
3 changed files with 320 additions and 41 deletions
+9
View File
@@ -0,0 +1,9 @@
# Installed by ./deploy.sh as /etc/NetworkManager/conf.d/zz-van-wan-pending.conf only while the
# WAN netplan (/etc/netplan/50-van-wan.yaml) is missing, i.e. before the uplink port has been
# handed to NetworkManager: until then systemd-networkd owns the port (DHCP lease, default route)
# and NM must leave it alone, or it shows up as "connected (externally)" and van-failover starts
# steering it. ./deploy.sh --apply-network removes this file right before it applies the netplan
# (and a rollback puts it back); a routine deploy removes it once the netplan matches.
# "+=" appends to the unmanaged list of van-ap-unmanaged.conf; the zz- name sorts after it.
[keyfile]
unmanaged-devices+=interface-name:@STARLINK_IFACE@