fix(wireguard): deactivate imported configs so import never arms a tunnel

nmcli connection import both sets autoconnect yes and activates the profile immediately. The configs are full-tunnel (AllowedIPs 0.0.0.0/0), so a bare import brings the tunnel up and routes everything through it. Importing a file silently connected a VPN, leaving the machine exiting through Proton.

Follow each import's autoconnect-off modify with a connection down, so importing only ever adds inactive profiles.

1 files changed, 10 insertions, 4 deletions

diff --git a/scripts/import-wireguard-configs.sh b/scripts/import-wireguard-configs.sh
index ae6ca7e..9e42033 100755
--- a/scripts/import-wireguard-configs.sh
+++ b/scripts/import-wireguard-configs.sh
@@ -10,9 +10,12 @@
 #   interface, which is fine (they're mutually exclusive full-tunnel
 #   configs), and the wg prefix keeps the net doctor's tunnel-down repair
 #   on the NM path.
-# - Imports default to autoconnect yes, and these are full-tunnel
-#   (AllowedIPs 0.0.0.0/0) — a VPN that arms itself on boot is not a default
-#   anyone chose, so the modify runs immediately after each import.
+# - `nmcli connection import` both sets autoconnect yes AND activates the
+#   profile immediately. These are full-tunnel (AllowedIPs 0.0.0.0/0), so a
+#   bare import silently brings the tunnel up and routes everything through it
+#   — a VPN nobody asked for by importing a file. Each import is therefore
+#   followed by a modify (autoconnect no) and a deactivate (connection down),
+#   so importing only ever adds inactive profiles.
 #
 # A connection still literally named wgpvpn means an earlier run died
 # between import and rename — and it still has autoconnect on. The script
@@ -54,6 +57,9 @@ for conf in "$dir"/*.conf; do
     fi
     nmcli connection modify "$uuid" connection.id "$name" \
         connection.autoconnect no
-    echo "imported: $name (autoconnect off, iface wgpvpn)"
+    # nmcli import auto-activates; bring it back down so importing never leaves
+    # a tunnel up. A profile that didn't activate makes this a harmless no-op.
+    nmcli connection down "$uuid" >/dev/null 2>&1 || true
+    echo "imported: $name (inactive, autoconnect off, iface wgpvpn)"
 done
 [ "$found" = 1 ] || { echo "no .conf files in $dir" >&2; exit 1; }