From 89b91d3ca7d72bbd1f5a1bd6458c3a22728db3f1 Mon Sep 17 00:00:00 2001
From: Ian Kelling <ian@iankelling.org>
Date: Fri, 9 Oct 2026 06:59:44 -0400
Subject: [PATCH] wireguard fixes

---
 brc2                                          | 40 +++++++++++++++----
 .../systemd/system/wg-quick-tr-pre@.service   |  1 +
 .../systemd/system/wg-quick-tr-pre@.service   |  3 +-
 .../etc/systemd/system/wg-quick-tr@.service   |  4 +-
 .../systemd/system/wg-quick-tr-pre@.service   |  1 +
 .../etc/openvpn/client-config-hole/frodo      |  2 +-
 .../systemd/system/wg-quick-tr-pre@.service   |  1 +
 .../systemd/system/wg-quick-tr-pre@.service   |  1 +
 .../systemd/system/wg-quick-tr-pre@.service   |  1 +
 .../systemd/system/wg-quick-tr-pre@.service   |  1 +
 .../systemd/system/wg-quick-tr-pre@.service   |  1 +
 .../systemd/system/wg-quick-tr-pre@.service   |  1 +
 .../systemd/system/wg-quick-tr-pre@.service   |  1 +
 mail-setup                                    | 18 ++++++---
 14 files changed, 58 insertions(+), 18 deletions(-)

diff --git a/brc2 b/brc2
index 172e006..3c3ac99 100644
--- a/brc2
+++ b/brc2
@@ -1541,12 +1541,35 @@ apache-strip() {
 }
 
 chro() {
+  local prtmp pid ret=0
   if type -p chromium &>/dev/null; then
     cmd=chromium
   else
     cd /
     cmd="schroot -c bookworm chromium"
-    CHROMIUM_FLAGS='--enable-remote-extensions' $cmd -- "$@" & r
+  fi
+  # without --no-sandbox, it fails due to not having user namespaces
+  # enabled. As of 2026, User namespaces has too often been a
+  # mechanism for giving root rather than being useful as a security
+  # measure.
+  echo "iank: running CHROMIUM_FLAGS=--enable-remote-extensions $cmd -- --no-sandbox $*"
+  CHROMIUM_FLAGS=--enable-remote-extensions $cmd -- --no-sandbox "$@" &
+  pid=$!
+  # wait in case it dies right away so that we print the output instead of exiting
+  sleep 2
+  prtmp=$(jobs -s; jobs -r)
+  if (( ${#prtmp} != 0  )); then
+    printf '\n\n\n\n\n#################\n\n'
+    echo "iank: exiting this shell for convenience"
+    sleep 0.5
+    r
+  else
+    # background: The pid arg is required to get the exit code.
+    wait $pid || ret=$?
+    printf '\n\n\n\n\n#################\n\n'
+    echo "iank: detected chromium exit with success (perhaps it was already running). exiting this shell for convenience"
+    sleep 2
+    r
   fi
 }
 
@@ -2200,6 +2223,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.$ipsuf start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
@@ -2322,12 +2346,13 @@ EOF
     for host in ${!vpn_ips[@]}; do
       ipsuf=${vpn_ips[$host]}
       cat <<EOF
-$host	A	10.0.0.$ipsuf
 ${host}wg	A	10.8.0.$ipsuf
 ${host}vp	A	10.5.5.$ipsuf
 ${host}tr	A	10.174.$ipsuf.2
 ${host}i	CNAME   i.b8.nz.
 EOF
+      if [[ $host == frodo ]]; then ipsuf=1; fi # notes in host-info
+      printf '%s\n' "$host	A	10.0.0.$ipsuf"
     done
   } | cedit -e vpn-ips-update /p/c/machine_specific/vps/bind-initial/db.b8.nz
 
@@ -3839,10 +3864,9 @@ sdnncmd() {
   m sudo nsenter -t $pid -n sudo -u $USER -i bash -c ". $tmpf"
 }
 
-
-mailnnbash() {
-  sdnbashroot mailnn
-}
+ mailnnbash() {
+   sdnbashroot wg-quick-mail
+ }
 
 # we use wireguard now, use mailnnbash.
 # mailvpnbash() {
@@ -3869,6 +3893,7 @@ nmtc() {
   s nmtui-connect "$@"
 }
 
+## todo: fix, mailnn unit is old and no longer exists.
 # check exim and others network namespace
 mailnncheck() {
   local unit pid ns mailnn spamd_ser
@@ -3935,8 +3960,7 @@ vpni() {
 vpnbash() {
   local n="$1" ser_suf=tr
   if [[ $n ]]; then ser_suf=nn; fi
-  #m sudm nsenter --net=/var/run/netns/client bash # only gets netns
-  sdncmdroot wg-quick-$ser_suf@client$n.service bash
+  m sdncmdroot wg-quick-$ser_suf@client$n.service bash
 }
 
 
diff --git a/machine_specific/bo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/bo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 7f228e7..ee8e5ad 100644
--- a/machine_specific/bo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/bo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.29 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
diff --git a/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 128c86c..4687ad8 100644
--- a/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,7 +3,8 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.1 start %i
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
+ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.34 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
 
diff --git a/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr@.service b/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr@.service
index b2ef48a..2afc643 100644
--- a/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr@.service
+++ b/machine_specific/frodo/filesystem/etc/systemd/system/wg-quick-tr@.service
@@ -9,11 +9,11 @@ Documentation=man:wg(8)
 Type=simple
 ExecReload=/bin/bash -c 'exec /usr/bin/wg syncconf %i <(exec /usr/bin/wg-quick strip %i)'
 ExecStartPre=/sbin/iptables-restore /a/bin/distro-setup/transmission-firewall/netns.rules
-ExecStartPre=/usr/sbin/ip r add 10.8.0.0/24 via 10.174.1.1 dev veth1-client
+ExecStartPre=/usr/sbin/ip r add 10.8.0.0/24 via 10.174.34.1 dev veth1-client
 ExecStartPre=/usr/bin/wg-quick up %i
 ExecStart=/bin/sleep infinity
 ExecStopPost=/usr/bin/wg-quick down %i
-ExecStopPost=/usr/sbin/ip r del 10.8.0.0/24 via 10.174.1.1 dev veth1-client
+ExecStopPost=/usr/sbin/ip r del 10.8.0.0/24 via 10.174.34.1 dev veth1-client
 NetworkNamespacePath=/var/run/netns/%i
 BindReadOnlyPaths=/etc/tr-resolv:/run/systemd/resolve:norbind /etc/basic-nsswitch:/etc/resolved-nsswitch:norbind
 # copied from wg-quick@.service
diff --git a/machine_specific/kd/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/kd/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index a837dd7..8c071d5 100644
--- a/machine_specific/kd/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/kd/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.2 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
diff --git a/machine_specific/li/filesystem/etc/openvpn/client-config-hole/frodo b/machine_specific/li/filesystem/etc/openvpn/client-config-hole/frodo
index de17a56..7fbb17c 100644
--- a/machine_specific/li/filesystem/etc/openvpn/client-config-hole/frodo
+++ b/machine_specific/li/filesystem/etc/openvpn/client-config-hole/frodo
@@ -1 +1 @@
-ifconfig-push 10.5.5.1 255.255.255.0
+ifconfig-push 10.5.5.34 255.255.255.0
diff --git a/machine_specific/librestation01/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/librestation01/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 62c0982..b4565db 100644
--- a/machine_specific/librestation01/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/librestation01/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.97 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
diff --git a/machine_specific/librestation03/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/librestation03/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 16560d1..c771a5b 100644
--- a/machine_specific/librestation03/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/librestation03/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.99 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
diff --git a/machine_specific/sf/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/sf/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 554ea54..e8b3f0b 100644
--- a/machine_specific/sf/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/sf/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.9 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
diff --git a/machine_specific/so/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/so/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index e59c922..2d5280a 100644
--- a/machine_specific/so/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/so/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.3 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
diff --git a/machine_specific/sy/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/sy/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 31c0184..ea43189 100644
--- a/machine_specific/sy/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/sy/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.7 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
diff --git a/machine_specific/x2/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/x2/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 9e231e3..c4979e6 100644
--- a/machine_specific/x2/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/x2/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.28 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
diff --git a/machine_specific/x3/filesystem/etc/systemd/system/wg-quick-tr-pre@.service b/machine_specific/x3/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
index 9370efe..e7bc80f 100644
--- a/machine_specific/x3/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
+++ b/machine_specific/x3/filesystem/etc/systemd/system/wg-quick-tr-pre@.service
@@ -3,6 +3,7 @@ Description=Initial setup of netns for wg-quick-tr %I
 
 [Service]
 Type=oneshot
+ExecStartPre=/p/c/mullvad-wg-config-validate %i
 ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns -n 10.174.8 start %i
 ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
 RemainAfterExit=yes
diff --git a/mail-setup b/mail-setup
index d4987ff..c27d7ed 100755
--- a/mail-setup
+++ b/mail-setup
@@ -19,6 +19,7 @@
 
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+
 # TODO: on desktop, somehow
 # exim updates screwed up the config file, probably by generating it
 # outside of the normal processes. I'm tracking those changes via
@@ -913,8 +914,12 @@ fi
 #
 #1: unify the mail vpn and wghole
 # into 1 network.  this seems simple and logical, so I'm doing it.
-# One general downside is tying things together, if I need to mess
-# with one thing, it breaks the other. Oh well for now.
+# Note: this is a bit confusing because we intentionally have
+# mail host netns interface + wghole interface on the same host
+# with different ips on the same net. Looks like a bug at first glance,
+# but it is just a convenient way to have static ip & routing rules
+# for the mail ip which the mail host adopts, while wghole ips vary
+# per host.
 #
 # 2. We can route 10.5.3.0/24 out of the mail nn and nat it into wghole.
 #
@@ -4849,9 +4854,9 @@ fi
 
 case $HOSTNAME in
   $MAIL_HOST|bk)
-    # If any of these have config changes, then restart them as needed:
-    # sre  wg-quick-mail
-    son wg-quick-mail
+    # note: this is sre instead of son because wireguard can fail in multiple
+    # ways but the unit will show as running fine.
+    sre wg-quick-mail
     ;;&
   $MAIL_HOST)
     # If this service's config changes, add a manual restart here.
@@ -4891,7 +4896,8 @@ case $HOSTNAME in
     ;;&
 esac
 
-## wip to only restart services that actually need restarting.
+## wip (does nothing yet) to only restart services that actually need
+## restarting.
 all_units=(
   wg-quick-mail.service
   unbound.service
-- 
2.30.2