itsolutionsfactory · toritsf · Jun 15, 2026 · May 26, 2026 · May 27, 2026 · Jun 12, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,7 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [1.3.0]
+
+### Added
+- **WireGuard dispatcher** : automatic VPN startup via NetworkManager dispatcher
+  - VPN is skipped when connected to the corporate network (`ITSF-Wifi`)
+  - VPN waits for a valid IP assignment on the WiFi interface before attempting to connect
+  - VPN waits for actual connectivity to the WireGuard endpoint (`vpn-user.itsf.io`) before starting
+  - All dispatcher decisions are logged to the system journal (`journalctl -t nm-dispatcher`)
+
+### Changed
+- **WireGuard** : disabled NetworkManager `autoconnect` on the `itsf` connection — startup is now fully managed by the dispatcher
+
+## [1.2.0]
 
 ### Removed
 - **GNOME Configuration Module**: Removed entire gnome-config module due to installation issues

diff --git a/apt-packages/wireguard-setup.sh b/apt-packages/wireguard-setup.sh
@@ -52,7 +52,6 @@ print_header "WireGuard Setup and Configuration"
 
 # Ask user if they want to set up WireGuard
 print_status "This script will set up WireGuard VPN configuration for ITSF."
-print_warning "You will need to provide the last digit of your IP address (e.g., 101 for 192.168.66.101)."
 echo
 read -p "$(echo -e "${YELLOW}Do you want to set up WireGuard VPN? (y/N): ${BASE}")" -n 1 -r
 echo
@@ -177,13 +176,96 @@ EOF
 import_networkmanager_connection() {
     print_status "Importing WireGuard connection to NetworkManager"
 
+    # Check if connection already exists
+    if sudo nmcli connection show itsf >/dev/null 2>&1; then
+        print_warning "Connection 'itsf' already exists. Removing it first..."
+        sudo nmcli connection delete itsf >/dev/null 2>&1 || true
+    fi
+
     # Import the configuration to NetworkManager
     sudo nmcli connection import type wireguard file /etc/wireguard/itsf.conf
 
+    # Disable autoconnect to prevent VPN from starting at boot
+    sudo nmcli connection modify itsf connection.autoconnect no
+
     print_success "WireGuard connection imported to NetworkManager"
     print_warning "You can now manage the connection through NetworkManager"
 }
 
+# Function to install dispatcher script for auto VPN management
+install_dispatcher_script() {
+    print_status "Installing dispatcher script for auto VPN management..."
+    DISPATCHER_SCRIPT="/etc/NetworkManager/dispatcher.d/20-itsf-vpn"
+    sudo tee "$DISPATCHER_SCRIPT" > /dev/null << 'DISPATCHER_EOF'
+#!/bin/bash
+IFACE=$1
+EVENT=$2
+VPN_NAME="itsf"
+CORP_SSID="ITSF-Wifi"
+CORP_DNS_1="10.195.28.20"
+CORP_DNS_2="10.195.28.50"
+MAX_WAIT=8
+
+wait_for_ip() {
+    local attempt=0
+    while [[ $attempt -lt $MAX_WAIT ]]; do
+        ip addr show "$IFACE" | grep -q 'inet ' && return 0
+        sleep 0.5
+        (( attempt++ ))
+    done
+    logger -t nm-dispatcher "itsf-vpn: timeout waiting for IP on $IFACE"
+    return 1
+}
+
+wait_for_dns() {
+    local attempt=0
+    while [[ $attempt -lt $MAX_WAIT ]]; do
+        timeout 2 resolvectl query --interface="$IFACE" gitlab.steelhome.internal &>/dev/null && return 0
+        sleep 0.5
+        (( attempt++ ))
+    done
+    logger -t nm-dispatcher "itsf-vpn: timeout waiting for DNS on $IFACE"
+    return 1
+}
+
+is_on_corp_network() {
+    local active_dns
+    active_dns=$(nmcli dev show "$IFACE" 2>/dev/null | grep 'IP4.DNS' | awk '{print $2}')
+    echo "$active_dns" | grep -qE "^($CORP_DNS_1|$CORP_DNS_2)$"
+}
+
+case "$EVENT" in
+    up)
+        [[ "$IFACE" =~ ^wl ]] || exit 0
+        CURRENT_SSID=$(nmcli -t -f active,ssid dev wifi | grep '^yes' | cut -d: -f2) || true
+        if [[ "$CURRENT_SSID" == "$CORP_SSID" ]] || is_on_corp_network; then
+            logger -t nm-dispatcher "itsf-vpn: corporate network detected, VPN skipped"
+            exit 0
+        fi
+        wait_for_ip || logger -t nm-dispatcher "itsf-vpn: IP timeout, continuant"
+        wait_for_dns || logger -t nm-dispatcher "itsf-vpn: DNS timeout, continuant"
+        if nmcli connection show --active | grep -q "$VPN_NAME"; then
+            logger -t nm-dispatcher "itsf-vpn: VPN déjà actif, skipping"
+            exit 0
+        fi
+        nmcli connection up "$VPN_NAME"
+        logger -t nm-dispatcher "itsf-vpn: VPN $VPN_NAME started on $IFACE (SSID: $CURRENT_SSID)"
+        ;;
+    down)
+        if nmcli connection show --active | grep -q "$VPN_NAME"; then
+            nmcli connection down "$VPN_NAME"
+            logger -t nm-dispatcher "itsf-vpn: VPN $VPN_NAME arrêté après WiFi down"
+        fi
+        ;;
+esac
+
+exit 0
+DISPATCHER_EOF
+    sudo chmod 700 "$DISPATCHER_SCRIPT"
+    sudo chown root:root "$DISPATCHER_SCRIPT"
+    print_success "Dispatcher script installed: $DISPATCHER_SCRIPT"
+}
+
 # Function to show WireGuard status
 show_wireguard_status() {
     print_status "WireGuard status:"
@@ -197,14 +279,24 @@ show_wireguard_status() {
 # Main setup process
 print_status "Starting ITSF WireGuard setup..."
 
-# Generate keys
-generate_keys
-
-# Create ITSF configuration
-create_itsf_config
-
-# Import to NetworkManager
-import_networkmanager_connection
+# Generate keys if the private key doesn't exist, or just install the dispatcher if it does
+if sudo [ -f "$WIREGUARD_DIR/keys/private.key" ]; then
+    print_warning "Keys already exist. Skipping key generation..."
+    print_status "Updating dispatcher script and NetworkManager connection only..."
+    import_networkmanager_connection
+    install_dispatcher_script
+else
+    generate_keys
+
+    # Create ITSF configuration
+    create_itsf_config
+
+    # Import to NetworkManager
+    import_networkmanager_connection
+
+    # Install dispatcher script
+    install_dispatcher_script
+fi
 
 # Show status
 show_wireguard_status

diff --git a/infra-tools-kit/diag-log-report.sh b/infra-tools-kit/diag-log-report.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+RUN_USER_HOME="${SUDO_USER:+$(getent passwd "$SUDO_USER" | cut -d: -f6)}"
+OUTPUT_DIR="$(pwd)/log-diag-$(date +%Y%m%d-%H%M%S)"
+mkdir -p "$OUTPUT_DIR"
+LOG="$OUTPUT_DIR/report.txt"
+
+sep() { echo -e "\n========== $1 ==========\n" | tee -a "$LOG"; }
+run() { echo "--- $1 ---" | tee -a "$LOG"; eval "$2" 2>&1 | tee -a "$LOG" || true; echo | tee -a "$LOG"; }
+run_boot() {
+    local label="$1"
+    local boot="$2"
+    local cmd="$3"
+    echo "--- $label [boot $boot] ---" | tee -a "$LOG"
+    eval "$cmd" 2>&1 | tee -a "$LOG" || echo "(aucun résultat ou boot non disponible)" | tee -a "$LOG"
+    echo | tee -a "$LOG"
+}
+
+echo "=== Log Diagnostic Report ===" | tee "$LOG"
+echo "Date   : $(date)" | tee -a "$LOG"
+echo "Host   : $(hostname)" | tee -a "$LOG"
+echo "User   : ${SUDO_USER:-$(whoami)}" | tee -a "$LOG"
+echo "PWD    : $(pwd)" | tee -a "$LOG"
+echo | tee -a "$LOG"
+
+sep "BOOTS DISPONIBLES"
+run "Liste des boots" "journalctl --list-boots --no-pager 2>/dev/null"
+
+sep "SYSTEME"
+run "OS / Kernel"        "uname -a && lsb_release -a 2>/dev/null || cat /etc/os-release"
+run "Modele PC"          "dmidecode -s system-product-name 2>/dev/null || cat /sys/devices/virtual/dmi/id/product_name 2>/dev/null"
+run "CPU"                "lscpu | grep -E 'Model name|Architecture|CPU\(s\)|Thread|Socket'"
+run "RAM totale"         "free -h"
+run "Firmware / BIOS"    "dmidecode -s bios-version 2>/dev/null || echo 'Non disponible'"
+
+for BOOT in -1 0; do
+    if [ "$BOOT" = "0" ]; then LABEL="BOOT ACTUEL (boot 0)"; else LABEL="BOOT PRECEDENT (boot -1)"; fi
+    sep "$LABEL"
+    run_boot "Erreurs critiques"      "$BOOT" "journalctl -b $BOOT --priority=3 --no-pager"
+    run_boot "Freeze / Hang / OOM"    "$BOOT" "journalctl -b $BOOT --no-pager | grep -iE 'freeze|hang|killed|oom|segfault|taint|panic|rcu_sched|soft lockup|hard lockup' || echo 'Rien trouve'"
+    run_boot "MCE / RAM errors"       "$BOOT" "journalctl -b $BOOT --no-pager | grep -iE 'mce|memory error|edac|corrected' || echo 'Rien trouve'"
+    run_boot "fprintd logs"           "$BOOT" "journalctl -b $BOOT -u fprintd --no-pager || echo 'Service fprintd non trouve'"
+    run_boot "PAM / unlock / auth"    "$BOOT" "journalctl -b $BOOT --no-pager | grep -iE 'pam|fprintd|fingerprint|gdm|gnome-screensaver|unlock' | tail -40 || echo 'Rien trouve'"
+    run_boot "GPU / DRM"              "$BOOT" "journalctl -b $BOOT --no-pager | grep -iE 'drm|gpu|i915|amdgpu|nouveau|xe|timeout|reset|hang' | tail -50 || echo 'Rien trouve'"
+    run_boot "GNOME Shell / GDM"      "$BOOT" "journalctl -b $BOOT -u gdm -u gnome-shell --no-pager | tail -60 || echo 'Rien trouve'"
+    run_boot "Wayland / Mutter"       "$BOOT" "journalctl -b $BOOT --no-pager | grep -iE 'mutter|wayland|compositor' | tail -30 || echo 'Rien trouve'"
+    run_boot "Thermal / throttling"   "$BOOT" "journalctl -b $BOOT --no-pager | grep -iE 'thermal|temperature|overheat|throttl|critical trip' | tail -20 || echo 'Rien trouve'"
+    run_boot "IO / NVMe errors"       "$BOOT" "journalctl -b $BOOT --no-pager | grep -iE 'nvme|sata|ata|io error|blk_update_request' | tail -30 || echo 'Rien trouve'"
+    run_boot "OOM killer"             "$BOOT" "journalctl -b $BOOT --no-pager | grep -iE 'out of memory|oom.killer|killed process' || echo 'Pas de OOM detecte'"
+    run_boot "USB / HID / fingerprint" "$BOOT" "journalctl -b $BOOT --no-pager | grep -iE 'usb|hid|fingerprint reader|goodix|elan|validity' | tail -30 || echo 'Rien trouve'"
+done
+
+sep "ETAT ACTUEL DU SYSTEME"
+run "Swap"                "swapon --show 2>/dev/null; free -h"
+run "Processus lourds"    "ps aux --sort=-%mem | head -15"
+run "Kernel logs recents" "dmesg --level=err,crit,warn 2>/dev/null | tail -40"
+run "fprintd status"      "systemctl status fprintd --no-pager 2>/dev/null || echo 'Service non trouve'"
+run "Modules kernel HID"  "lsmod 2>/dev/null | grep -iE 'hid_sensor|i2c|thunderbolt|mei' || echo 'Rien trouve'"
+run "Xorg errors user"    "[ -n \"${RUN_USER_HOME:-}\" ] && grep '(EE)' \"$RUN_USER_HOME/.local/share/xorg/Xorg.0.log\" 2>/dev/null || echo 'Pas de log Xorg user'"