# Installed to /etc/systemd/system/ppp@pppoe0.service.d/10-vrrp-wan-gate.conf
#
# This drop-in is the ONLY thing preventing both routers from dialling the one
# ISP credential at the same time. Do not remove it without reading this.
#
# pppoe0 is configured identically and ENABLED on both routers, because the
# alternative -- `set interfaces pppoe pppoe0 disable` -- unlinks
# /etc/ppp/peers/pppoe0 (interfaces_pppoe.py treats `disable` and `delete`
# identically), and pppd's options file IS that path. A promotion then had to
# re-render it via a full config commit at priority 322, where one unrelated
# invalid node fails the whole commit and takes the 10 gig down with it. It also
# made op-mode `connect interface pppoe0` unusable, since that refuses when the
# peers file is absent.
#
# With the node enabled, interfaces_pppoe.py's apply() does this on EVERY commit
# that touches the pppoe subtree:
#
#     if not is_systemd_service_running('ppp@pppoe0.service') or shutdown_required:
#         call('systemctl restart ppp@pppoe0.service')
#
# -- i.e. the backup actively tries to dial whenever anything commits. A
# `pulumi up`, a `sim-net-apply.sh apply`, or the boot-time config load are all
# that commit. This gate is what makes that a no-op.
#
# /run is tmpfs, so the gate is shut at boot on both boxes and neither can dial
# before VRRP has decided. ppp@.service is already After=vyos-router.service, so
# no extra ordering is needed.
[Unit]
# Both must hold; multiple ConditionPathExists are ANDed.
#   may-dial       -- vrrp-wan-reconcile has blessed this box (a renewed lease)
#   /etc/ppp/peers -- refuse to start pppd against a missing options file, which
#                     is what produced a restart loop of 47 and counting on
#                     2026-09-05. A failed Condition is NOT a failure: the job
#                     succeeds, the unit stays inactive, and `systemctl start`
#                     exits 0 -- so callers must check is-active, never rc.
ConditionPathExists=/run/vrrp-wan/may-dial
ConditionPathExists=/etc/ppp/peers/pppoe0

# Belt to that brace. The stock unit is Restart=on-failure/RestartSec=5s against
# systemd's default StartLimitIntervalSec=10s/Burst=5 -- two restarts per window,
# so the limiter can never trip and a doomed pppd retries for ever.
StartLimitIntervalSec=600
StartLimitBurst=6

[Service]
RestartSec=15
# A hung pppd must be resolved inside the failover budget. The stock 90s means a
# demoted router could still hold the session while the new master is dialling.
# 20s still allows a clean LCP Terminate + PADT in the normal case.
TimeoutStopSec=20