From 78a370dbd1ec2ef6a7b28acaf95cf533f2042ca3 Mon Sep 17 00:00:00 2001
From: Ruakij <ruakij@ruekov.eu>
Date: Mon, 26 Oct 2026 19:15:45 +0000
Subject: [PATCH] wireguard-ipv6-converter: verified download, restart upheld
 while the interface is up, percent signs escaped for systemd

---
 wireguard-ipv6-converter/tasks/deploy.yml                    | 3 +++
 .../templates/wg-ipv6-conv-restart.conf.jinja2               | 5 +++++
 .../templates/wg-ipv6-conv.service.jinja2                    | 3 ++-
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/wireguard-ipv6-converter/tasks/deploy.yml b/wireguard-ipv6-converter/tasks/deploy.yml
index 595e19e..6c51b6e 100644
--- a/wireguard-ipv6-converter/tasks/deploy.yml
+++ b/wireguard-ipv6-converter/tasks/deploy.yml
@@ -8,4 +8,7 @@
     url: https://github.com/Ruakij/wg-ipv6-converter/releases/{{ versionUri }}/wg-ipv6-converter_{{ arch }}
     dest: /usr/local/bin/wg-ipv6-converter
     mode: "744"
+    # Replaces a differing binary (get_url keeps an existing dest without a
+    # checksum) and verifies the download.
+    checksum: "sha256:https://github.com/Ruakij/wg-ipv6-converter/releases/{{ versionUri }}/SHA256SUMS"
   register: deployDownload
diff --git a/wireguard-ipv6-converter/templates/wg-ipv6-conv-restart.conf.jinja2 b/wireguard-ipv6-converter/templates/wg-ipv6-conv-restart.conf.jinja2
index 768df34..ab00135 100644
--- a/wireguard-ipv6-converter/templates/wg-ipv6-conv-restart.conf.jinja2
+++ b/wireguard-ipv6-converter/templates/wg-ipv6-conv-restart.conf.jinja2
@@ -3,5 +3,10 @@
 # interface without its IPv6 addresses. Start it again whenever
 # {{ wireguard_ipv6_converter.service.bindTo }} starts. --no-block because the converter orders
 # itself After={{ wireguard_ipv6_converter.service.bindTo }}.
+# Upholds= additionally restarts the converter whenever it stops while
+# {{ wireguard_ipv6_converter.service.bindTo }} is active, e.g. after it exhausted its start limit.
+[Unit]
+Upholds=wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}.service
+
 [Service]
 ExecStartPost=/bin/systemctl --no-block start wg-ipv6-converter_{{ wireguard_ipv6_converter.setup.interface }}.service
diff --git a/wireguard-ipv6-converter/templates/wg-ipv6-conv.service.jinja2 b/wireguard-ipv6-converter/templates/wg-ipv6-conv.service.jinja2
index e1544a0..05ebc2e 100644
--- a/wireguard-ipv6-converter/templates/wg-ipv6-conv.service.jinja2
+++ b/wireguard-ipv6-converter/templates/wg-ipv6-conv.service.jinja2
@@ -16,7 +16,8 @@ RestartSec=30
 
 Environment="INTERFACE={{ wireguard_ipv6_converter.setup.interface }}"
 {% if wireguard_ipv6_converter.setup.ipv6_format is defined %}
-Environment="IPV6_FORMAT={{ wireguard_ipv6_converter.setup.ipv6_format }}"
+{# systemd expands specifiers in Environment=, so every % must be doubled. #}
+Environment="IPV6_FORMAT={{ wireguard_ipv6_converter.setup.ipv6_format | replace('%', '%%') }}"
 {% endif %}
 {% if wireguard_ipv6_converter.setup.filter_prefix is defined %}
 Environment="FILTER_PREFIX={{ wireguard_ipv6_converter.setup.filter_prefix }}"