Template NM WAN pieces: netplan split, cellular keyfile, new host variables

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

ap/50-van-wan-wifi.yaml

@@ -0,0 +1,23 @@
+  wifis:
+    @WIFI_WAN_IFACE@:
+      renderer: NetworkManager
+      optional: true
+      dhcp4: true
+      # IPv6 is deliberate as of 2026-07-12: NM does SLAAC/DHCPv6 itself.
+      # Before this it only worked by accident — dracut's runtime catch-all
+      # /run/systemd/network/zzzz-dracut-default.network had networkd
+      # co-managing wlan0 (second DHCPv4 client + surprise IPv6); deploy.sh
+      # now masks that file. Privacy (temporary) addresses stay off so hbd
+      # and DNS see one stable source address per uplink.
+      dhcp6: true
+      ipv6-privacy: false
+      # never-default: see the Starlink stanza above — same reasoning, applies to every
+      # van-failover-managed WAN.
+      networkmanager:
+        passthrough:
+          ipv4.never-default: "true"
+      access-points:
+        "Wapana":
+          auth:
+            key-management: "psk"
+            password: "6e1335fd97165a7d2618bec19824be363a2766d7765f91aa14773d871eaa59dc"

ap/50-van-wan.yaml

@@ -33,26 +33,3 @@ network:
       networkmanager:
         passthrough:
           ipv4.never-default: "true"
-  wifis:
-    @WIFI_WAN_IFACE@:
-      renderer: NetworkManager
-      optional: true
-      dhcp4: true
-      # IPv6 is deliberate as of 2026-07-12: NM does SLAAC/DHCPv6 itself.
-      # Before this it only worked by accident — dracut's runtime catch-all
-      # /run/systemd/network/zzzz-dracut-default.network had networkd
-      # co-managing wlan0 (second DHCPv4 client + surprise IPv6); deploy.sh
-      # now masks that file. Privacy (temporary) addresses stay off so hbd
-      # and DNS see one stable source address per uplink.
-      dhcp6: true
-      ipv6-privacy: false
-      # never-default: see the Starlink stanza above — same reasoning, applies to every
-      # van-failover-managed WAN.
-      networkmanager:
-        passthrough:
-          ipv4.never-default: "true"
-      access-points:
-        "Wapana":
-          auth:
-            key-management: "psk"
-            password: "6e1335fd97165a7d2618bec19824be363a2766d7765f91aa14773d871eaa59dc"

ap/cellular.nmconnection

@@ -0,0 +1,19 @@
+# NetworkManager connection for the cellular WAN (see failover/config.json, van-failover).
+# Created by deploy.sh only when absent; never rewritten. No modem needs to be present.
+# never-default: van-failover is the sole owner of the default route (same as the Wi-Fi/Starlink profiles).
+[connection]
+id=@CELLULAR_CONN_NAME@
+uuid=@CELLULAR_UUID@
+type=gsm
+autoconnect=true
+
+[gsm]
+apn=@CELLULAR_APN@
+
+[ipv4]
+method=auto
+route-metric=300
+never-default=true
+
+[ipv6]
+method=auto