wireguard-ipv6-converter: verified download, restart upheld while the interface is up, percent signs escaped for systemd

wireguard-ipv6-converter/tasks/deploy.yml

@@ -8,4 +8,7 @@
     url: https://github.com/Ruakij/wg-ipv6-converter/releases/{{ versionUri }}/wg-ipv6-converter_{{ arch }}
     dest: /usr/local/bin/wg-ipv6-converter
     mode: "744"
+    # Replaces a differing binary (get_url keeps an existing dest without a
+    # checksum) and verifies the download.
+    checksum: "sha256:https://github.com/Ruakij/wg-ipv6-converter/releases/{{ versionUri }}/SHA256SUMS"
   register: deployDownload

wireguard-ipv6-converter/templates/wg-ipv6-conv-restart.conf.jinja2

@@ -3,5 +3,10 @@
 # interface without its IPv6 addresses. Start it again whenever
 # {{ wireguard_ipv6_converter.service.bindTo }} starts. --no-block because the converter orders
 # itself After={{ wireguard_ipv6_converter.service.bindTo }}.
+# Upholds= additionally restarts the converter whenever it stops while
+# {{ wireguard_ipv6_converter.service.bindTo }} is active, e.g. after it exhausted its start limit.
+[Unit]
+Upholds=wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}.service
+
 [Service]
 ExecStartPost=/bin/systemctl --no-block start wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}.service

wireguard-ipv6-converter/templates/wg-ipv6-conv.service.jinja2

@@ -16,7 +16,8 @@ RestartSec=30
 
 Environment="INTERFACE={{ wireguard_ipv6_converter.setup.interface }}"
 {% if wireguard_ipv6_converter.setup.ipv6_format is defined %}
-Environment="IPV6_FORMAT={{ wireguard_ipv6_converter.setup.ipv6_format }}"
+{# systemd expands specifiers in Environment=, so every % must be doubled. #}
+Environment="IPV6_FORMAT={{ wireguard_ipv6_converter.setup.ipv6_format | replace('%', '%%') }}"
 {% endif %}
 {% if wireguard_ipv6_converter.setup.filter_prefix is defined %}
 Environment="FILTER_PREFIX={{ wireguard_ipv6_converter.setup.filter_prefix }}"