wifis:
    @WIFI_WAN_IFACE@:
      renderer: NetworkManager
      optional: true
      dhcp4: true
      # IPv6 is deliberate as of 2026-07-12: NM does SLAAC/DHCPv6 itself.
      # Before this it only worked by accident — dracut's runtime catch-all
      # /run/systemd/network/zzzz-dracut-default.network had networkd
      # co-managing wlan0 (second DHCPv4 client + surprise IPv6); deploy.sh
      # now masks that file. Privacy (temporary) addresses stay off so hbd
      # and DNS see one stable source address per uplink.
      dhcp6: true
      ipv6-privacy: false
      # never-default: see the Starlink stanza above — same reasoning, applies to every
      # van-failover-managed WAN.
      networkmanager:
        passthrough:
          ipv4.never-default: "true"
      access-points:
        "Wapana":
          auth:
            key-management: "psk"
            password: "6e1335fd97165a7d2618bec19824be363a2766d7765f91aa14773d871eaa59dc"