diff options
Diffstat (limited to 'scripts')
| -rwxr-xr-x | scripts/import-wireguard-configs.sh | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/scripts/import-wireguard-configs.sh b/scripts/import-wireguard-configs.sh index ae6ca7e..9e42033 100755 --- a/scripts/import-wireguard-configs.sh +++ b/scripts/import-wireguard-configs.sh @@ -10,9 +10,12 @@ # interface, which is fine (they're mutually exclusive full-tunnel # configs), and the wg prefix keeps the net doctor's tunnel-down repair # on the NM path. -# - Imports default to autoconnect yes, and these are full-tunnel -# (AllowedIPs 0.0.0.0/0) — a VPN that arms itself on boot is not a default -# anyone chose, so the modify runs immediately after each import. +# - `nmcli connection import` both sets autoconnect yes AND activates the +# profile immediately. These are full-tunnel (AllowedIPs 0.0.0.0/0), so a +# bare import silently brings the tunnel up and routes everything through it +# — a VPN nobody asked for by importing a file. Each import is therefore +# followed by a modify (autoconnect no) and a deactivate (connection down), +# so importing only ever adds inactive profiles. # # A connection still literally named wgpvpn means an earlier run died # between import and rename — and it still has autoconnect on. The script @@ -54,6 +57,9 @@ for conf in "$dir"/*.conf; do fi nmcli connection modify "$uuid" connection.id "$name" \ connection.autoconnect no - echo "imported: $name (autoconnect off, iface wgpvpn)" + # nmcli import auto-activates; bring it back down so importing never leaves + # a tunnel up. A profile that didn't activate makes this a harmless no-op. + nmcli connection down "$uuid" >/dev/null 2>&1 || true + echo "imported: $name (inactive, autoconnect off, iface wgpvpn)" done [ "$found" = 1 ] || { echo "no .conf files in $dir" >&2; exit 1; } |