# /etc/netplan/50-van-wan.yaml — replaces cloud-init's 50-cloud-init.yaml.
# The WANs handed to NetworkManager so van-failover can steer them (mirrors
# wayback where NM owns all WANs): wlan0 = wifi uplink (Wapana at home /
# campsite wifi), enxd8ec5eeb3512 = Starlink. The AP radios and the wired LAN
# ports (USB dongle + onboard eth0, since 2026-07-12 an internal LAN port) are
# deliberately absent: systemd-networkd/hostapd own them, and
# van-ap-unmanaged.conf hides them from NM.
# Apply once by hand: netplan generate && netplan apply (flaps the uplinks).
network:
  version: 2
  ethernets:
    # Starlink dish uplink (RTL8153 USB NIC, MAC-named — travels with the
    # adapter, see STARLINK_IFACE in deploy.conf). The /32 link route keeps the
    # dish's management address reachable no matter which WAN holds the
    # default route: the dish answers on 192.168.100.1 (gRPC :9200) even while
    # the uplink sits behind CGNAT.
    @STARLINK_IFACE@:
      renderer: NetworkManager
      optional: true
      dhcp4: true
      routes:
        - to: 192.168.100.1/32
          scope: link
      # never-default: van-failover is the sole owner of the default route (it manages it
      # directly via `ip route`, deliberately never `nmcli device reapply`d — that resets
      # r8152 USB-ethernet carriers). Without this, NM's own DHCP client reinstalls its own
      # default route (metric 100, NM's ethernet default) on every lease renewal — observed
      # every ~8s here (dish hands out a 16s lease) — which van-failover's loop prunes within
      # ~1s, but during that window it can tie wifi's own healthy base metric (also 100).
      # Setting this at connection-creation time (vs. a live `nmcli modify`, which does NOT
      # take effect on an already-active connection without a reactivation) closes the race
      # for good.
      networkmanager:
        passthrough:
          ipv4.never-default: "true"
  wifis:
    wlan0:
      renderer: NetworkManager
      optional: true
      dhcp4: true
      # IPv6 is deliberate as of 2026-07-12: NM does SLAAC/DHCPv6 itself.
      # Before this it only worked by accident — dracut's runtime catch-all
      # /run/systemd/network/zzzz-dracut-default.network had networkd
      # co-managing wlan0 (second DHCPv4 client + surprise IPv6); deploy.sh
      # now masks that file. Privacy (temporary) addresses stay off so hbd
      # and DNS see one stable source address per uplink.
      dhcp6: true
      ipv6-privacy: false
      # never-default: see the Starlink stanza above — same reasoning, applies to every
      # van-failover-managed WAN.
      networkmanager:
        passthrough:
          ipv4.never-default: "true"
      access-points:
        "Wapana":
          auth:
            key-management: "psk"
            password: "6e1335fd97165a7d2618bec19824be363a2766d7765f91aa14773d871eaa59dc"