feat(vpn): wireguard config import for the NM migration

scripts/import-wireguard-configs.sh imports the seven Proton configs into NetworkManager with autoconnect forced off. Each config stages through a wgpvpn.conf temp copy (NM's import name must be a valid interface name; several config names exceed the 15-char limit) and is renamed by the UUID parsed from the import output, so a stray same-named connection can't be hit. A leftover wgpvpn connection — a run that died between import and rename, autoconnect still armed — makes the script refuse to run. 10 tests over a fake nmcli; velox migration verified (all seven wireguard, autoconnect no). The tunnels spec is implemented: all six phases shipped.

1 files changed, 45 insertions, 0 deletions

diff --git a/tests/import-wireguard-configs/fake-nmcli b/tests/import-wireguard-configs/fake-nmcli
new file mode 100644
index 0000000..45b88cd
--- /dev/null
+++ b/tests/import-wireguard-configs/fake-nmcli
@@ -0,0 +1,45 @@
+#!/bin/bash
+# Fake nmcli for the import-wireguard-configs tests.
+#
+# Behavior is driven by env vars set by the test harness:
+#   FAKE_NMCLI_LOG    file every invocation's args are appended to (one line
+#                     per call; for imports the staged file's basename and
+#                     content hash context are visible in the args)
+#   FAKE_NMCLI_NAMES  newline-separated connection names returned by
+#                     `nmcli -t -f NAME connection show`
+#   FAKE_NMCLI_IMPORT_OUT  override for the import command's stdout
+#                     (default: the real NM success line with a per-call
+#                     deterministic UUID)
+#   FAKE_NMCLI_MODIFY_RC   exit code for `nmcli connection modify` (default 0)
+#
+# Import calls also copy the staged file into $FAKE_NMCLI_LOG.d/ so tests can
+# assert the temp copy was named wgpvpn.conf and carried the right content.
+set -euo pipefail
+
+echo "$*" >>"$FAKE_NMCLI_LOG"
+
+case "$1 $2" in
+"-t -f")
+    # nmcli -t -f NAME connection show
+    printf '%s\n' "${FAKE_NMCLI_NAMES:-}"
+    ;;
+"connection import")
+    # nmcli connection import type wireguard file <path>
+    file="${6:?}"
+    mkdir -p "$FAKE_NMCLI_LOG.d"
+    n=$(find "$FAKE_NMCLI_LOG.d" -type f | wc -l)
+    cp "$file" "$FAKE_NMCLI_LOG.d/import-$n-$(basename "$file")"
+    if [ -n "${FAKE_NMCLI_IMPORT_OUT:-}" ]; then
+        echo "$FAKE_NMCLI_IMPORT_OUT"
+    else
+        printf "Connection 'wgpvpn' (%08d-aaaa-bbbb-cccc-dddddddddddd) successfully added.\n" "$n"
+    fi
+    ;;
+"connection modify")
+    exit "${FAKE_NMCLI_MODIFY_RC:-0}"
+    ;;
+*)
+    echo "fake-nmcli: unexpected args: $*" >&2
+    exit 99
+    ;;
+esac