0119 review: rollback needs the private network unassigned first; a configuration written back is retired again with the first original kept; only the interface's own file, never a link

2026-09-27 00:58:54 +02:00
parent 2f195d501e
commit 63c19456b4
1 changed files with 11 additions and 2 deletions
@@ -64,8 +64,17 @@ is removed from where its unit reads it.**
  carries the same key, port, address and peers.
 - A take that is never proven — no peer ever handshakes — keeps the found configuration, and the
  node says so, so a broken take is visible rather than silently retired.
- Rolling back to the predecessor's tunnel becomes a deliberate act: copy the kept original back
-  and start its unit. The mesh does neither.
+- Rolling back to the predecessor's tunnel becomes a deliberate act, in this order: **unassign the
+  private network first**, then copy the kept original back and start its unit. The mesh does
+  neither. While the private network is still assigned, the tunnel is the mesh's: a restored
+  configuration is held and retired again at the next proven apply, and the found unit cannot
+  bind the port the mesh's interface holds. The node says so when it happens.
+- A configuration something keeps writing back — the predecessor's own tooling, say — is retired
+  again each time it appears, but the first original stays the one kept; a different content is
+  kept once beside it, and the node reports that the configuration came back.
+- The host retires only the found interface's own configuration file (`/etc/wireguard/<iface>.conf`),
+  never a path the mesh writes, and never a link: a configuration that is a link to somewhere else
+  is left, with its target, for a person to retire.
 - 0105's "its configuration stays on disk, kept like any held file" holds until the take is proven,
  and not after.