{% set vrf_command = 'ip vrf exec ' ~ vrf ~ ' ' if vrf is vyos_defined else '' %}
{% set no_release = '-n' if dhcpv6_options.no_release is vyos_defined else '' %}
{% set dhcp6c_options = '-D -k ' ~ dhcp6_client_dir ~ '/dhcp6c.' ~ ifname ~ '.sock -c ' ~ dhcp6_client_dir ~ '/dhcp6c.' ~ ifname ~ '.conf -p ' ~ dhcp6_client_dir ~ '/dhcp6c.' ~ ifname ~ '.pid ' ~ no_release %}

[Unit]
ConditionPathExists={{ dhcp6_client_dir }}/dhcp6c.{{ ifname }}.conf
{% if ifname.startswith('pppoe') %}
After=ppp@{{ ifname }}.service
{% endif %}

[Service]
ExecStartPre=cp /etc/wide-dhcpv6/dhcp6cctlkey {{ dhcp6_client_dir }}/dhcp6c.{{ ifname }}.sock
ExecStart=
ExecStart={{ vrf_command }}/usr/sbin/dhcp6c {{ dhcp6c_options }} {{ ifname }}
WorkingDirectory={{ dhcp6_client_dir }}
PIDFile={{ dhcp6_client_dir }}/dhcp6c.{{ ifname }}.pid

#!/usr/bin/env bash
# Update DNS information for DHCPv6 clients
# should be used only if vyos-hostsd is running

if /usr/bin/systemctl -q is-active vyos-hostsd; then
    hostsd_client="/usr/bin/vyos-hostsd-client"
    hostsd_changes=

    if [ -n "$new_domain_name" ]; then
        logmsg info "Deleting search domains with tag \"dhcpv6-{{ ifname }}\" via vyos-hostsd-client"
        $hostsd_client --delete-search-domains --tag "dhcpv6-{{ ifname }}"
        logmsg info "Adding domain name \"$new_domain_name\" as search domain with tag \"dhcpv6-{{ ifname }}\" via vyos-hostsd-client"
        $hostsd_client --add-search-domains "$new_domain_name" --tag "dhcpv6-{{ ifname }}"
        hostsd_changes=y
    fi

    if [ -n "$new_domain_name_servers" ]; then
        logmsg info "Deleting nameservers with tag \"dhcpv6-{{ ifname }}\" via vyos-hostsd-client"
        $hostsd_client --delete-name-servers --tag "dhcpv6-{{ ifname }}"
        logmsg info "Adding nameservers \"$new_domain_name_servers\" with tag \"dhcpv6-{{ ifname }}\" via vyos-hostsd-client"
        $hostsd_client --add-name-servers $new_domain_name_servers --tag "dhcpv6-{{ ifname }}"
        hostsd_changes=y
    fi

    if [ $hostsd_changes ]; then
        logmsg info "Applying changes via vyos-hostsd-client"
        $hostsd_client --apply
    else
        logmsg info "No changes to apply via vyos-hostsd-client"
    fi
fi

# dhcp6c hook: on each valid Reply, arm renew (T1), rebind (T2), and a guard before pltime for {{ ifname }}.

set -euo pipefail
TAG="dhcp6c-hook"
log(){ local p="${1:-info}"; shift||true; systemd-cat -t "$TAG" -p "$p" <<<"${*:-}"; }

UNIT="dhcp6c@{{ ifname }}.service"
LOOKBACK="2 minutes ago"
WAKER="/config/scripts/dhcp6c-waker.sh"

[[ -x "$WAKER" ]] || log warning "waker not found at $WAKER; create it first"

# Collect recent logs for this interface
J="$(journalctl -u "$UNIT" --since "$LOOKBACK" --no-pager 2>/dev/null || true)"

# SAFEGUARD: only proceed if this recent reply shows PD success
if ! grep -Eq 'update_ia: status code for PD-[0-9]+: success' <<<"$J"; then
  log info "no PD success found in recent reply for {{ ifname }}; skip scheduling"
  exit 0
fi

# Parse T1/T2 from IA_PD line; pltime from IA_PD prefix line
T1=""; T2=""; PLTIME=""
LIA="$(grep -E 'IA_PD: .* T1=[0-9]+, T2=[0-9]+' <<<"$J" | tail -n1 || true)"
LPD="$(grep -E 'IA_PD prefix: .* pltime=[0-9]+' <<<"$J" | tail -n1 || true)"
[[ -n "$LIA" ]] && T1="$(sed -n 's/.*T1=\([0-9]\+\).*/\1/p' <<<"$LIA")" && T2="$(sed -n 's/.*T2=\([0-9]\+\).*/\1/p' <<<"$LIA")"
[[ -n "$LPD" ]] && PLTIME="$(sed -n 's/.*pltime=\([0-9]\+\).*/\1/p' <<<"$LPD")"

# Clean any previous transient units for this iface
systemctl stop  "dhcp6c-renew@{{ ifname }}.timer"  "dhcp6c-renew@{{ ifname }}.service"  >/dev/null 2>&1 || true
systemctl stop  "dhcp6c-rebind@{{ ifname }}.timer" "dhcp6c-rebind@{{ ifname }}.service" >/dev/null 2>&1 || true
systemctl stop  "dhcp6c-guard@{{ ifname }}.timer"  "dhcp6c-guard@{{ ifname }}.service"  >/dev/null 2>&1 || true
systemctl reset-failed "dhcp6c-renew@{{ ifname }}.service" "dhcp6c-rebind@{{ ifname }}.service" "dhcp6c-guard@{{ ifname }}.service" >/dev/null 2>&1 || true

# (1) Renew (T1): exact seconds
if [[ -n "$T1" && "$T1" -gt 0 ]]; then
  systemd-run --quiet --collect \
    --unit="dhcp6c-renew@{{ ifname }}.service" \
    --property=Type=oneshot \
    --property=Description="DHCPv6 renew on {{ ifname }}" \
    --on-active="${T1}s" \
    --timer-property=AccuracySec=1s \
    --timer-property=Persistent=false \
    "$WAKER" "{{ ifname }}"
  log info "armed renew (T1=${T1}s) for {{ ifname }}"
fi

# (2) Rebind (T2): exact seconds; only fires if no Reply after T1
if [[ -n "$T2" && "$T2" -gt 0 ]]; then
  systemd-run --quiet --collect \
    --unit="dhcp6c-rebind@{{ ifname }}.service" \
    --property=Type=oneshot \
    --property=Description="DHCPv6 rebind on {{ ifname }}" \
    --on-active="${T2}s" \
    --timer-property=AccuracySec=1s \
    --timer-property=Persistent=false \
    "$WAKER" "{{ ifname }}"
  log info "armed rebind (T2=${T2}s) for {{ ifname }}"
fi

# (3) Guard: before preferred-lifetime hits 0 (offset configurable; default 60s)
GUARD_OFFSET="${GUARD_OFFSET:-60}"     # set 0 to fire exactly at pltime expiry
if [[ -n "$PLTIME" && "$PLTIME" -gt 0 ]]; then
  delay=$(( PLTIME - GUARD_OFFSET ))
  (( delay < 1 )) && delay=1
  systemd-run --quiet --collect \
    --unit="dhcp6c-guard@{{ ifname }}.service" \
    --property=Type=oneshot \
    --property=Description="Guard before pltime on {{ ifname }} (dhcp6ctl start)" \
    --on-active="${delay}s" \
    --timer-property=AccuracySec=1s \
    --timer-property=Persistent=false \
    "$WAKER" "{{ ifname }}"
  log info "armed guard: now+${delay}s (pltime=${PLTIME}s) for {{ ifname }}"
else
  log warning "no pltime found for $UNIT; guard not scheduled"
fi

#!/usr/bin/env bash
set -euo pipefail

# Wake/renew dhcp6c for ONE iface (required arg) by issuing:
#   dhcp6ctl start interface <iface>
# Assumes per-iface control key exists at /run/dhcp6c/dhcp6c.<iface>.sock.

TAG="dhcp6c-waker"
log(){ local p="${1:-info}"; shift || true; systemd-cat -t "$TAG" -p "$p" <<<"${*:-}"; }
usage(){ echo "usage: $0 <iface>"; }

# --- arg parsing
if [[ $# -ne 1 ]]; then
  log err "missing iface argument"; usage; exit 2
fi
IFACE="$1"
UNIT="dhcp6c@${IFACE}.service"
KEY="/run/dhcp6c/dhcp6c.${IFACE}.sock"       # key file (not a socket)
FALLBACK_KEY="/etc/wide-dhcpv6/dhcp6cctlkey" # optional fallback

# --- sanity checks
if ! ip link show dev "$IFACE" &>/dev/null; then
  log err "iface $IFACE not found"; exit 1
fi
# Allow UNKNOWN (e.g., PPPoE); skip only if clearly down
if ! ip link show dev "$IFACE" 2>/dev/null | grep -Eq 'state (UP|LOWER_UP|UNKNOWN)'; then
  log info "iface $IFACE appears DOWN; skip"
  exit 0
fi

# --- ensure key (prefer per-iface; optional fallback to global)
if [[ ! -r "$KEY" ]]; then
  if [[ -r "$FALLBACK_KEY" ]]; then
    log warning "missing per-iface key $KEY; falling back to $FALLBACK_KEY"
    KEY="$FALLBACK_KEY"
  else
    log err "no control key for $IFACE ($KEY or $FALLBACK_KEY)"; exit 1
  fi
fi

# --- kick dhcp6c (prefer dhcp6ctl start; fallback to systemctl restart)
if command -v dhcp6ctl >/dev/null 2>&1; then
  if dhcp6ctl -C -k "$KEY" start interface "$IFACE" >/dev/null 2>&1 \
  || dhcp6ctl -C -k "$KEY" -p 5546 start interface "$IFACE" >/dev/null 2>&1 \
  || dhcp6ctl -C -k "$KEY" -p 5547 start interface "$IFACE" >/dev/null 2>&1
  then
    log info "dhcp6ctl start OK (iface=$IFACE)"
  else
    log warning "dhcp6ctl start failed; restarting $UNIT"
    systemctl restart "$UNIT" >/dev/null 2>&1 || { log err "systemctl restart failed"; exit 1; }
  fi
else
  log warning "dhcp6ctl not installed; restarting $UNIT"
  systemctl restart "$UNIT" >/dev/null 2>&1 || { log err "systemctl restart failed"; exit 1; }
fi

# --- re-announce via radvd (best-effort)
systemctl reload radvd >/dev/null 2>&1 || systemctl restart radvd >/dev/null 2>&1 || true
log info "radvd reloaded after waking $IFACE"

prefix ::/64 {
    decrement-lifetime
    deprecate-prefix
    preferred-lifetime 172800 # your ISP pltime value for prefix delegation
    valid-lifetime 259200 # your ISP vltime value for prefix delegation
}