lan: repurpose onboard eth0 as an internal LAN port on br0

With wifi + Starlink + cellular as uplinks, the onboard GbE earns its keep
as a wired LAN port instead of the metric-150 ethernet WAN: eth0 leaves
netplan/NM (added to van-ap-unmanaged.conf) and joins br0 via networkd
(23-van-lan-eth0.network), so wired clients get 10.42.0.x DHCP/DNS and NAT
exactly like Wi-Fi clients. The eth WAN is gone from van-failover's config.

Cutover notes: delete the old netplan-eth0 / stray eth0 NM profiles, then
nmcli general reload + networkctl reload/reconfigure eth0. NEVER cable this
port (or the USB LAN dongle) back into an upstream LAN — dnsmasq on br0
would serve rogue DHCP there; STP stays off, so don't cable both wired LAN
ports to the same switch either.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ap/20-van-br0.netdev

@@ -1,6 +1,7 @@
-# LAN bridge: joins the AP Wi-Fi (added by hostapd, once it's in AP mode) and the
-# wired LAN port (enx00e04c331140, added by networkd) into one 10.42.0.0/24 segment.
-# STP off: only two member ports, no loops, and it avoids the forwarding delay that
+# LAN bridge: joins the AP Wi-Fi radios (added by hostapd, once in AP mode) and the
+# wired LAN ports (enx00e04c331140 + onboard eth0, added by networkd) into one
+# 10.42.0.0/24 segment. STP off: all members are leaf ports, no loops (don't cable
+# the two wired ports to the same switch), and it avoids the forwarding delay that
 # would otherwise stall the first DHCP handshake on a freshly-plugged client.
 [NetDev]
 Name=br0

ap/23-van-lan-eth0.network

@@ -0,0 +1,13 @@
+# Onboard GbE (RP1 eth0) as the internal LAN port: enslaved to br0 so anything
+# plugged in lands on 10.42.0.0/24 with DHCP/DNS from the same dnsmasq as Wi-Fi
+# clients. Was the metric-150 ethernet WAN until 2026-07-12 — with wifi +
+# Starlink + cellular as uplinks, the wired port earns its keep as LAN instead.
+# NM must leave it alone (see van-ap-unmanaged.conf) for networkd to own it here.
+[Match]
+Name=eth0
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+Bridge=br0

ap/50-van-wan.yaml

@@ -1,18 +1,14 @@
 # /etc/netplan/50-van-wan.yaml — replaces cloud-init's 50-cloud-init.yaml.
-# Both onboard interfaces plus the Starlink USB NIC are WANs handed to
-# NetworkManager so van-failover can steer them (mirrors wayback where NM owns
-# all WANs): wlan0 = wifi uplink (Wapana at home / campsite wifi), eth0 =
-# ethernet uplink, enxd8ec5eeb3512 = Starlink. The AP radios and
-# the wired LAN port (USB dongles, wlx*/enx* MAC-named) are deliberately absent:
-# systemd-networkd/hostapd own them, and van-ap-unmanaged.conf hides them from NM.
-# Apply once by hand: netplan generate && netplan apply (flaps both uplinks).
+# The WANs handed to NetworkManager so van-failover can steer them (mirrors
+# wayback where NM owns all WANs): wlan0 = wifi uplink (Wapana at home /
+# campsite wifi), enxd8ec5eeb3512 = Starlink. The AP radios and the wired LAN
+# ports (USB dongle + onboard eth0, since 2026-07-12 an internal LAN port) are
+# deliberately absent: systemd-networkd/hostapd own them, and
+# van-ap-unmanaged.conf hides them from NM.
+# Apply once by hand: netplan generate && netplan apply (flaps the uplinks).
 network:
   version: 2
   ethernets:
-    eth0:
-      renderer: NetworkManager
-      optional: true
-      dhcp4: true
     # Starlink dish uplink (RTL8153 USB NIC, MAC-named — travels with the
     # adapter). The /32 link route keeps the dish's management address reachable
     # no matter which WAN holds the default route: the dish answers on

ap/van-ap-unmanaged.conf

@@ -1,4 +1,5 @@
 [keyfile]
-# The AP wlans (5GHz + 2.4GHz) and the wired LAN port are all owned by
-# systemd-networkd/hostapd (bridged into br0), so NetworkManager must not touch them.
-unmanaged-devices=interface-name:wlxc83a35a4ee55;interface-name:wlxd8ec5e2faa8c;interface-name:enx00e04c331140
+# The AP wlans (5GHz + 2.4GHz) and the wired LAN ports (USB dongle + onboard
+# eth0) are all owned by systemd-networkd/hostapd (bridged into br0), so
+# NetworkManager must not touch them.
+unmanaged-devices=interface-name:wlxc83a35a4ee55;interface-name:wlxd8ec5e2faa8c;interface-name:enx00e04c331140;interface-name:eth0

deploy.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # Deploy vanlink configs/scripts (Pi 4 "wan" port) to their system locations.
 # Usage:  cd ~/vanlink && sudo ./deploy.sh
-# Idempotent. Netplan (onboard eth0+wlan0 = NM-managed WANs) is NOT touched here —
-# reference copy in ap/50-van-wan.yaml, applied once manually (apply flaps uplinks).
+# Idempotent. Netplan (wlan0 + Starlink NIC = NM-managed WANs; eth0 is a LAN
+# port on br0) is NOT touched here — reference copy in ap/50-van-wan.yaml,
+# applied once manually (apply flaps uplinks).
 set -euo pipefail
 cd "$(dirname "$(readlink -f "$0")")"
 [ "$(id -u)" = 0 ] || { echo "Run with sudo (writes to /etc, /usr)."; exit 1; }
@@ -24,6 +25,7 @@ install -D -m0644 ap/10-van-ap.network      /etc/systemd/network/10-van-ap.netwo
 install -D -m0644 ap/20-van-br0.netdev      /etc/systemd/network/20-van-br0.netdev
 install -D -m0644 ap/21-van-br0.network     /etc/systemd/network/21-van-br0.network
 install -D -m0644 ap/22-van-lan.network     /etc/systemd/network/22-van-lan.network
+install -D -m0644 ap/23-van-lan-eth0.network /etc/systemd/network/23-van-lan-eth0.network
 install -D -m0644 ap/van-ap-unmanaged.conf  /etc/NetworkManager/conf.d/van-ap-unmanaged.conf
 install -D -m0644 ap/nftables.conf          /etc/nftables.conf
 install -D -m0644 ap/regdomain.service      /etc/systemd/system/regdomain.service

failover/config.json

@@ -10,7 +10,6 @@
   ],
   "wans": [
     { "name": "wifi",     "device": "wlan0",           "metric": 100 },
-    { "name": "eth",      "device": "eth0",            "metric": 150 },
     { "name": "starlink", "device": "enxd8ec5eeb3512", "metric": 200 },
     { "name": "cellular", "connection": "Koodo",       "metric": 300 }
   ]