From 722cad1ac3f273f4c451ff0438bb321743ddeff7 Mon Sep 17 00:00:00 2001 From: Andreas Wrede Date: Wed, 23 Sep 2026 19:54:25 -0400 Subject: [PATCH] netplan: restore the Pi-identical comment; rollback re-runs van-br0-setup - ap/50-van-wan.yaml: revert the comment to "see STARLINK_IFACE in deploy.conf" so the rendered file is byte-identical to the Pi 5's installed netplan (it otherwise reports "differs" forever); note in deploy.sh next to render_wan_netplan. - check 14: baseline 3d117e7, keep byte-identity for wan.conf, assert no /etc/vanlink.conf; the failure branch no longer aborts the suite under pipefail. - helper restore(): restart van-br0-setup (unit present, timeout 30, non-fatal) after the re-apply, before the connectivity re-check; asserted in the rollback sandbox scenario. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9 --- ap/50-van-wan.yaml | 2 +- deploy.sh | 11 +++++++++-- tests/check-templates.sh | 10 ++++++++-- 3 files changed, 18 insertions(+), 5 deletions(-) diff --git a/ap/50-van-wan.yaml b/ap/50-van-wan.yaml index 617b21c..dff0943 100644 --- a/ap/50-van-wan.yaml +++ b/ap/50-van-wan.yaml @@ -10,7 +10,7 @@ network: version: 2 ethernets: # Starlink dish uplink (RTL8153 USB NIC, MAC-named — travels with the - # adapter, see STARLINK_IFACE in /etc/vanlink.conf). The /32 link route keeps the + # adapter, see STARLINK_IFACE in deploy.conf). The /32 link route keeps the # dish's management address reachable no matter which WAN holds the # default route: the dish answers on 192.168.100.1 (gRPC :9200) even while # the uplink sits behind CGNAT. diff --git a/deploy.sh b/deploy.sh index 0a54324..d6998e9 100755 --- a/deploy.sh +++ b/deploy.sh @@ -106,6 +106,9 @@ render() { # render -> stdout, with @TOKEN@ placeholders substituted # The netplan is two templates: ap/50-van-wan.yaml (ethernet/Starlink) and # ap/50-van-wan-wifi.yaml (the wifis: stanza, appended verbatim only for hosts # with a Wi-Fi uplink, so a host without one gets no empty/invalid wifis: block). +# The rendered netplan must stay byte-identical to what live hosts have installed (comments included: +# nm_wan_state_netplan compares bytes, and "differs" invites an --apply-network that flaps the uplinks). +# Do not edit comments in ap/50-van-wan*.yaml without re-checking `--wan-plan` on every host. render_wan_netplan() { # ap/50-van-wan.yaml, plus the wifis stanza when the host has a Wi-Fi uplink render ap/50-van-wan.yaml if [ -n "${WIFI_WAN_IFACE:-}" ]; then @@ -401,7 +404,7 @@ PY # (netplan generate/apply run under timeout -k AN_KILL_T: +AN_KILL_T each in the worst case) # forward path AN_FWD = NM conf reload + generate + apply + 2*kill + van-br0-setup (unit check + restart) # + stage 1 + restart + stage 2 + networkd info line + diagnostics (logged once, on a failed gate) -# rollback path AN_RB = generate + apply + 2*kill + NM conf reload + restart + connectivity recheck +# rollback path AN_RB = generate + apply + 2*kill + NM conf reload + van-br0-setup (unit check + restart) + restart + connectivity recheck # helper worst case AN_HELPER_MAX = AN_FWD + AN_RB + AN_SLOP (loop iterations overshoot their # deadline by a few nmcli/ping timeouts) # foreground waits AN_WAIT = AN_HELPER_MAX + 30 @@ -413,7 +416,7 @@ PY AN_KILL_T=10 AN_APPLY_T=90 AN_GEN_T=30 AN_NM_T=5 AN_RESTART_T=30 AN_S1=60 AN_S2=120 AN_RC=60 AN_SLOP=60 AN_DIAG=$(( 5 * AN_NM_T )) # diag(): five commands, each under timeout AN_NM_T AN_FWD=$(( AN_NM_T + AN_GEN_T + AN_APPLY_T + 2 * AN_KILL_T + AN_NM_T + AN_RESTART_T + AN_S1 + AN_RESTART_T + AN_S2 + AN_NM_T + AN_DIAG )) -AN_RB=$(( AN_GEN_T + AN_APPLY_T + 2 * AN_KILL_T + AN_NM_T + AN_RESTART_T + AN_RC )) +AN_RB=$(( AN_GEN_T + AN_APPLY_T + 2 * AN_KILL_T + AN_NM_T + AN_NM_T + AN_RESTART_T + AN_RESTART_T + AN_RC )) AN_HELPER_MAX=$(( AN_FWD + AN_RB + AN_SLOP )) AN_WAIT=$(( AN_HELPER_MAX + 30 )) AN_RUNMAX=$(( AN_HELPER_MAX + 60 )) @@ -517,6 +520,10 @@ restore() { # restore : put the pre-run netplan back, re-check connecti fi timeout -k $AN_KILL_T $AN_GEN_T netplan generate && timeout -k $AN_KILL_T $AN_APPLY_T netplan apply || { [ "\$rb" != ok ] || rb=APPLY-FAILED; } [ ! -f "\$ncd/$pc" ] || timeout $AN_NM_T nmcli general reload conf || echo "nmcli general reload conf failed" + # the re-apply restarted networkd too, which can drop br0's members (as on the forward path; not gating) + if timeout $AN_NM_T systemctl cat van-br0-setup >/dev/null 2>&1; then + timeout $AN_RESTART_T systemctl restart van-br0-setup || echo "van-br0-setup restart failed (continuing)" + fi timeout $AN_RESTART_T systemctl restart van-failover || true end=\$((SECONDS+$d3)) while :; do diff --git a/tests/check-templates.sh b/tests/check-templates.sh index b9a0ea8..f6a1c70 100755 --- a/tests/check-templates.sh +++ b/tests/check-templates.sh @@ -207,12 +207,14 @@ done # 14. the netplan split leaves the Pi 5's rendered WAN netplan byte-identical, and the R5C (no Wi-Fi WAN) omits wifis old=$(mktemp) -git show 223652b:ap/50-van-wan.yaml > "$old" +# 3d117e7: the last commit with the original comments, byte-identical to what the Pi 5 has installed +git show 3d117e7:ap/50-van-wan.yaml > "$old" want=$(VANLINK_CONF=hosts/wan.conf ./deploy.sh render "$old") tmpw=$(mktemp) # render_wan_netplan is internal; expose it through --render-wan-netplan (documented in the header) VANLINK_CONF=hosts/wan.conf ./deploy.sh --render-wan-netplan > "$tmpw" -if [ "$want" = "$(cat "$tmpw")" ]; then ok "wan.conf: split netplan renders identical to the old single template"; else bad "wan.conf: netplan render changed by the split"; diff <(echo "$want") "$tmpw" | head -10 | sed 's/^/ /'; fi +if [ "$want" = "$(cat "$tmpw")" ]; then ok "wan.conf: split netplan renders identical to the old single template"; else bad "wan.conf: netplan render changed by the split"; diff <(echo "$want") "$tmpw" | head -10 | sed 's/^/ /' || true; fi +if grep -qF '/etc/vanlink.conf' "$tmpw"; then bad "wan.conf: rendered netplan mentions /etc/vanlink.conf (a comment was re-edited; live hosts would report differs)"; else ok "wan.conf: rendered netplan keeps the original comments (no /etc/vanlink.conf)"; fi if VANLINK_CONF=hosts/van.conf ./deploy.sh --render-wan-netplan | grep -q '^ wifis:'; then bad "van.conf: wifis stanza must be omitted (WIFI_WAN_IFACE empty)"; else ok "van.conf: no wifis stanza"; fi rm -f "$tmpw" "$old" @@ -445,6 +447,10 @@ STUB a_is "stage2 dhcp-only default route: exit 1" "$rc" 1; a_is "stage2 dhcp-only default route: status" "$(st_word)" rolled-back grep -q '^ip route show default dev enP2p33s0 proto static$' "$sb/calls" && ok "apply helper stage2: checks van-failover's proto static route on the port" || bad "apply helper stage2: no proto static route check" grep -qF -- '--- diagnostics: stage 2' "$sb/log" && ok "apply helper stage2: diagnostics logged" || bad "apply helper stage2: diagnostics missing" + # rollback: van-br0-setup restarted after the re-apply (the 2nd netplan apply), before the connectivity re-check (last ping) + l_ap2=$(grep -n '^netplan apply' "$sb/calls" | sed -n 2p | cut -d: -f1 || true); l_br2=$(grep -n '^systemctl restart van-br0-setup$' "$sb/calls" | sed -n 2p | cut -d: -f1 || true) + l_pg=$(grep -n '^ping -c1 -W2 1.1.1.1$' "$sb/calls" | tail -1 | cut -d: -f1 || true) + [ -n "$l_ap2" ] && [ -n "$l_br2" ] && [ -n "$l_pg" ] && [ "$l_ap2" -lt "$l_br2" ] && [ "$l_br2" -lt "$l_pg" ] && ok "apply helper rollback: van-br0-setup restarted after the re-apply, before the connectivity re-check" || bad "apply helper rollback: van-br0-setup restart missing or misplaced (apply '$l_ap2', br0 '$l_br2', ping '$l_pg')" [ -e "$sb/netplan/10-dhcp-all-interfaces.yaml" ] && cmp -s "$sb/nmconf/zz-van-wan-pending.conf" "$sb/bak/nm-pending.conf" && ok "apply helper stage2: Armbian file and pending conf restored" || bad "apply helper stage2: Armbian file / pending conf not restored" rm -rf "$sb" # (5c) port absent: stage 2 needs no proto static route on it