The routes/rules existence check only ran when the hash matched.
When the hash changed (e.g. DNS availability) but resolved IPs
were unchanged, routes were not reloaded even if empty in kernel.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

IPv6 addresses like 2a03:5a00:c:20::122 contain hex letters (a-f),
matching the *[a-zA-Z]* hostname pattern. Check for colon first to
handle IPv6 as literal addresses.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

grep '\t' in bracket expression matches literal backslash+t, not tab.
Use [^[:space:]] which works correctly with multipath nexthop lines.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Add check_extra_dns() to probe external DNS (8.8.8.8) reachability.
Skip it when unreachable to avoid timeouts. Include availability
in route-update.sh hash so routes re-resolve when DNS comes back.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Timeout errors from adnshost (especially via 8.8.8.8) should not
trigger dig fallback — retrying will also timeout. This was causing
10+ minute delays on hosts where 8.8.8.8 is unreachable.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Remove duplicated log/has_option, use read_value, ipcmd_for,
table_by_name, resolve_default_gw from shared functions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace inline definitions with shared functions: log, has_option,
rule_pref, resolve_gw, resolve_default_gw. Use read_value/read_values
instead of grep -v '^#' | grep -m1, ipcmd_for instead of manual
detection, table_by_name inside lookup_table.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Extract common functions used by both route-update.sh and route-health.sh:
- log, read_value, read_values, ipcmd_for, has_option, rule_pref
- table_by_name, resolve_default_gw, resolve_gw
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

route-update.service: loads/restores policy routes at boot and periodically (5min)
route-health.service: monitors gateway health and manages failover (1min)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The default (no args) mode already detects missing ip rules and empty
routing tables, making --set-rules redundant. This simplifies the
interface and service configuration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When a group has set-default in options, route-health.sh now reads
gateways in priority order and picks the first healthy one as default.
Also refactored health checking into get_health() helper and added
rt_tables lookup fallback for table resolution.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The set-default option in group options is now handled exclusively by
route-health.sh which has access to gateway health data from InfluxDB
and can make informed failover decisions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Gateway file now accepts hostnames in addition to IPs and "default".
Hostnames are resolved via dig (A for IPv4, AAAA for IPv6).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Filter out nexthop continuation lines (starting with tab) when counting
routes and detecting stale entries. Fixes incorrect count with multipath.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace flush+load with replace-all+remove-stale approach: routes are
never missing during reload. Add post-update route count verification.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Separate lists_hash tracks list file changes independently. When only
gateway or options file changed, reuse saved resolved IPs instead of
re-resolving all domains.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When saved table number differs from current (e.g. after manual rt_tables
edit), flush old table and ip rule before reloading into new table.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Table number is now resolved by: 1) legacy table file, 2) rt_tables by group
name, 3) last octet of gateway IP (auto-registered in rt_tables).

New options file support: set-default flag sets system default route via
group's gateway.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Update routes6.d structure: replace ogw with gre group (table 222)
- Fix NETMAP prefix /120 → /118, show igw as gateway (not egw)
- Add OpenVPN NAT66 and Xray L7 proxy sections
- Update ip rule show to include gre (pref 2220), add IPv6 packet flow
- Document --verbose flag and partial route loss detection (1% tolerance)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Previously auto-recovery only triggered when routing table was
completely empty. Now it also reloads when route count drops below
99% of expected (from resolved state file).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add --verbose/-v flag with detailed logging at all decision points:
  group config, hash comparison, rule/route checks, resolve stats
- Use ip -N (numeric) for rule show to avoid name vs number mismatch
  that could cause false-positive "no changes" when rules were missing
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Document routes6.d/ structure and IPv6 processing
- Add GRE tunnel + NPTv6 prefix translation diagram
- Document "default" keyword behavior for IPv4/IPv6
- Document IPv4 filtering in IPv6 mode
- Document automatic rules/routes recovery
- Note routes.d/ and routes6.d/ are site-specific (not in git)
- Update state section with gateway tracking
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When processing routes6.d, pure-IP list files may contain IPv4
addresses/subnets. Filter them out by only passing lines with ":"
(IPv6 addresses) in IPv6 mode.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

These directories contain deployment-specific config (gateways, tables,
symlinks to local lists) that vary per installation. Add .gitignore.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Pass ip command to read_group_config() so "default" keyword resolves
via "ip -6 route" for routes6.d groups instead of always using IPv4.
Also detect address family from directory location instead of gateway
content for --add/--del/--flush commands.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace fc00:eeee:eeee:eeee::1 placeholder with actual gateway
2a03:5a00:c:20::122 (CT 680 gre.hetzner).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

When ip rules or routing tables are empty (e.g. after networkctl
reconfigure), force reload even if list hashes match.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Support "default" keyword in gateway file to use the machine's default
route. Add dgw route group (table 2, pref 20) to override ogw/egw for
addresses that should go directly without tunnels.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Skips the file hash check but keeps the resolved IP diff,
so routes are only reloaded when DNS actually returns different IPs.
Useful for cron: `*/15 * * * * ./route-update.sh --resolve`
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>